OpenSSL fixes HollowByte denial-of-service flaw that can permanently bloat server memory with an 11-byte TLS payload

OpenSSL fixed a denial-of-service flaw called HollowByte that lets an unauthenticated attacker send a tiny crafted Transport Layer Security (TLS) handshake message and drive up server memory use. Okta said vulnerable OpenSSL versions allocate memory based on a claimed handshake length before the data arrives, allowing repeated 11-byte requests to fragment memory and keep resident memory high until restart. The fix is in OpenSSL 4.0.1 and backported to 3.6.3, 3.5.7, 3.4.6, and 3.0.21; no CVE was assigned.
Why it matters: OpenSSL sits underneath many web servers, apps, and Linux systems, so this can affect a wide range of internet-facing services even though it is not a code-execution bug. Organizations should update OpenSSL promptly and verify dependent services such as NGINX, Apache, and application runtimes are using fixed builds.

Sources

OpenSSL HollowByte Flaw Could Freeze Server Memory with 11-Byte TLS Requests
info@thehackernews.com (The Hacker News) 2026.07.17 98% relevant
This article covers the same HollowByte OpenSSL vulnerability event, describing the 11-byte TLS request denial-of-service issue and the affected OpenSSL software.
HollowByte DDoS flaw bloats OpenSSL server memory with 11-byte payload
Bill Toulas 2026.07.17 100% relevant
This article establishes a distinct new story: a named OpenSSL denial-of-service flaw, public technical details from Okta, and newly identified fixed versions, with no matching existing tracked story for this specific event.
← Back to all stories