In brief: An unpatched OpenSSL mishandles fragmented TLS messages and reserves memory that is not freed until the process restarts.
A vulnerability in OpenSSL allows attackers to permanently reserve up to 131 KB of server memory with just 11 bytes in a TLS request. OpenSSL distributed the patch in June without a CVE number or official announcement.
An attacker can use just eleven bytes in a specially crafted TLS request to force an OpenSSL server to reserve up to 131 kilobytes of memory for a message that never arrives completely. On glibc-based systems, this memory remains permanently bound until the affected process is restarted.
The problem arose from the faulty handling of fragmented TLS messages: OpenSSL allocates memory for the expected complete message but fails to free it if the fragments do not arrive. Repeated requests of this kind gradually lead to memory exhaustion and ultimately to denial of service of the server.
OpenSSL published a patch in June 2026, however without assigning a CVE number, without publishing a security advisory, and without including the fix in the changelog. Okta’s Red Team identified the vulnerability, named it “HollowByte,” and made the lack of transparency in the patch public. This significantly hampers administrators and enterprises in timely tracking and prioritization of security measures.
Source: thehackernews.com · Published July 17, 2026
Lumi AI News — AI-assisted curation pursuant to Article 50 EU AI Act. Paraphrase and classification by Lumi News Pipeline v1.7.3.