In a nutshell: HollowByte enables DoS attacks on OpenSSL-based servers through targeted memory fragmentation via false length field specifications in the TLS handshake; patches are available for multiple versions.
The HollowByte vulnerability in OpenSSL allows unauthenticated attackers to cause denial-of-service conditions on servers with minimal data consumption. A patch corrects faulty memory management during TLS handshakes.
Okta’s Red Team documented a vulnerability in the OpenSSL encryption library that allows attackers to conduct unauthenticated DoS attacks. During a TLS handshake, a four-byte header with a three-digit length field defines the size of the subsequent message. Affected OpenSSL versions allocated the requested memory immediately, before the actual data arrived or its true size was verified. A worker thread then blocks and waits indefinitely for data that never arrives.
In the attack, the attacker sends an eleven-byte message whose header falsely announces a very large data volume. When repeated across multiple connections, the server occupies large amounts of RAM through minimally sent data amounts. The memory management of the GNU C Library (glibc) does not immediately return small to medium memory releases to the operating system after connection termination, but retains them for possible reuse. By deliberately sending connection waves with randomly specified sizes, the attacker prevents the allocator from using these freed blocks. This results in severe heap fragmentation and continuous increase in the Resident Set Size (RSS), causing the server to remain permanently bloated.
OpenSSL libraries are integrated into widely distributed software: web servers like NGINX and Apache, runtime environments like Node.js, Python, Ruby, and PHP, as well as database systems like MySQL and PostgreSQL. Okta tested the attack scenario with NGINX and observed complete memory exhaustion on systems with limited capacity. On more powerful servers, available memory capacity decreased by up to 25 percent, while the required attack bandwidth remained below typical alert thresholds for security monitoring.
The OpenSSL team published a correction as a hardening measure without a separate CVE identification number. The bug was fixed in OpenSSL 4.0.1 and backported to older versions 3.6.3, 3.5.7, 3.4.6, and 3.0.21. The updated versions ignore the size specifications in the header and expand the buffer only when data actually arrives. Okta recommends operators to update OpenSSL packages from their distribution immediately.
Source: www.it-daily.net · Published 20 July 2026
Lumi AI News — AI-assisted curation according to Art. 50 EU AI Act. Paraphrase and classification by Lumi News Pipeline v1.7.3.