OpenSSL HollowByte Flaw Could Freeze Server Memory with 11-Byte TLS Requests
OpenSSL HollowByte flaw allows 11-byte TLS requests to exhaust server memory without CVE assignment.
OpenSSL shipped a fix in June 2026 for HollowByte, a denial-of-service vulnerability that allows attackers to freeze server memory by sending crafted TLS handshake headers claiming large message bodies that never arrive. The flaw, reported by Okta's Red Team, causes OpenSSL to allocate up to 131 KB per connection, and on glibc systems the memory fragments and is not reclaimed until process restart, enabling attackers to exhaust system memory without triggering connection limits. OpenSSL classified this as a "bug or hardening" fix rather than a vulnerability, omitting CVE assignment, advisory, and changelog documentation.
AI summary of the linked source. Not reviewed by an editor. How this works
Run OpenSSL Software Foundation?
Get an email when a new story names OpenSSL Software Foundation, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonThe HollowByte vulnerability exposes a critical resource management flaw in OpenSSL where malformed TLS handshake headers trick the server into pre-allocating up to 131 KB of memory per connection — memory that is never released on glibc-based systems until a process restart. An attacker needs only 11 bytes per request to trigger this, making denial-of-service attacks cheap and connection-rate limits ineffective as a defense. Compounding the risk, OpenSSL classified the fix as a 'hardening' change rather than a vulnerability, bypassing CVE assignment and formal advisories — meaning many organizations relying on vulnerability feeds alone would never know to patch. This highlights the danger of vendor classification decisions that obscure security impact and underscores why proactive patch tracking beyond CVE databases is essential.
What helps against this
How we list vendors
- Automated patch management
Known holes get closed in days, not months.
- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
- Next-generation firewall and intrusion prevention
Malicious traffic is blocked at the network edge and between zones.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- cve — CVE-2025-66199
- cve — CVE-2026-34183