HollowByte: 11 bytes are enough to saturate OpenSSL server memory

The HollowByte flaw in OpenSSL allows an attacker to send an 11-byte TLS request to inflate server memory until saturation. A rarely achieved attack-to-impact ratio, affecting a library present on millions of servers.

What

A vulnerability in OpenSSL, named HollowByte, allows an attacker to send a TLS request of just 11 bytes to trigger a disproportionate memory allocation on the server side—and take it offline. A DoS (Denial of Service) vector of concerning efficiency for such a small amount of data sent.

Who is affected

Any HTTPS, SMTP/TLS, or FTPS server using a vulnerable version of OpenSSL—potentially millions of servers worldwide. Most Linux distributions (Debian, Ubuntu, RHEL, Alpine) include OpenSSL; Docker containers often inherit the version from their base image.

How it works

HollowByte exploits a flaw in TLS extension processing during the handshake (the initial encrypted connection setup). When the server receives the malformed 11-byte request, it allocates up to 131 KB of memory per request before validating the data. The attacker repeats the operation in a loop to saturate the server’s RAM—without authentication, without an established session.

On glibc-based systems tested by Okta, this memory remains locked until the process restarts. A ratio of 11 incoming bytes to 131 KB allocated is rarely seen in classic DDoS amplification attacks.

A discreet patch, no CVE

Notable fact: OpenSSL released the HollowByte fix in June 2026—without a CVE assigned, no official advisory, and no changelog entry explicitly referencing the flaw. The discovery and detailed analysis were published after the fix by independent researchers and Okta.

Practical consequence: teams not closely tracking OpenSSL patches may have missed the issue without knowing.

Analysis

OpenSSL is not just a library for web servers. It is embedded in network equipment, containers, IoT devices, cloud services, and command-line tools. Its scope far exceeds Apache or nginx.

HollowByte does not allow code execution—it’s a DoS, not an RCE. But an offline production server is enough for extortion attacks or to mask a simultaneous intrusion by overwhelming response teams.

What to do now

• Check the installed OpenSSL version and ensure the June patch is applied
• Audit embedded versions in containers: openssl version—the base image may be outdated even if the rest is current
• Monitor unusual spikes in memory usage on your TLS servers
• Enable rate limiting on incoming TLS connections if your infrastructure allows