OpenSSL fixed a denial-of-service flaw called HollowByte that lets an unauthenticated attacker send a tiny crafted Transport Layer Security (TLS) handshake message and drive up server memory use. Okta said vulnerable OpenSSL versions allocate memory based on a claimed handshake length before the data arrives, allowing repeated 11-byte requests to fragment memory and keep resident memory high until restart. The fix is in OpenSSL 4.0.1 and backported to 3.6.3, 3.5.7, 3.4.6, and 3.0.21; no CVE was assigned.
Why it matters: OpenSSL sits underneath many web servers, apps, and Linux systems, so this can affect a wide range of internet-facing services even though it is not a code-execution bug. Organizations should update OpenSSL promptly and verify dependent services such as NGINX, Apache, and application runtimes are using fixed builds.
info@thehackernews.com (The Hacker News)
2026.07.17
98% relevant
This article covers the same HollowByte OpenSSL vulnerability event, describing the 11-byte TLS request denial-of-service issue and the affected OpenSSL software.
Bill Toulas
2026.07.17
100% relevant
This article establishes a distinct new story: a named OpenSSL denial-of-service flaw, public technical details from Okta, and newly identified fixed versions, with no matching existing tracked story for this specific event.
← Back to all stories