OpenSSL Patches HollowByte Vulnerability That Enables Denial-of-Service Attacks on TLS Connections with Just 11 Bytes

OpenSSL has issued updates to address a vulnerability known as HollowByte that can be exploited to launch denial-of-service attacks against servers relying on unpatched versions of the widely used cryptographic library.

The flaw allows an attacker to trigger excessive memory reservation during the initial negotiation of TLS connections by sending a specially crafted request of only 11 bytes. Because the issue was treated internally as a hardening measure rather than a critical security problem, it did not receive a CVE identifier or an official security advisory from the OpenSSL project.

Researchers at Okta discovered and reported the weakness, highlighting that its operational impact could be substantial for any server exposed to the internet. The root cause lies in how vulnerable OpenSSL versions allocate memory according to the message size declared by the client before confirming that the promised data will actually arrive.

An attacker can therefore open multiple connections, announce a large incoming message, and then transmit only a minimal portion of data. The server remains in a waiting state, holding the reserved memory until the connection times out or is closed, which can rapidly exhaust available resources.

Testing conducted with the NGINX web server demonstrated that systems with limited memory could be completely disabled, while more powerful machines experienced significant reductions in capacity even though the volume of network traffic did not appear unusual.

Fixed Versions and Recommended Actions

The correction has been incorporated into the following releases: OpenSSL 4.0.1, 3.6.3, 3.5.7, 3.4.6, and 3.0.21.

System administrators are urged to update OpenSSL packages through their distribution’s repositories, restart all services that load the library, and continuously monitor processes exposed to the internet for abnormal memory consumption.