OpenSSL HollowByte: 11 bytes are enough to saturate the memory of a TLS server
Cybersecurity Aug 9, 2026Add to bookmarks
HollowByte vulnerability in OpenSSL allows sending an 11-byte TLS request to freeze a server's memory. A formidable attack/defense asymmetry: minimal bandwidth, maximum impact.
What's happening
A vulnerability dubbed HollowByte affects OpenSSL—the cryptographic library securing most web HTTPS, SMTP, and VPN connections. The flaw allows an attacker to send a TLS request of just 11 bytes to trigger memory exhaustion on the server—up to 131 KB allocated per request on glibc systems, according to tests by Okta, which documented the flaw. This memory remains locked until the process restarts, rendering the server unable to handle further connections.
Notable point: OpenSSL released the HollowByte patch in June without a CVE, public advisory, or changelog entry referencing the flaw. A silent fix that explains why some administrators remain unaware of its existence.
Who is affected
All servers running OpenSSL versions prior to the June patch, meaning the vast majority of unpatched web infrastructure:
- HTTPS web servers (Apache, Nginx, etc.)
- Secure mail services (SMTPS, IMAPS)
- OpenSSL-based VPN servers
- Any network daemon whose dependencies include OpenSSL
Analysis
The asymmetry of this flaw is its most dangerous aspect. In a traditional DDoS attack, the attacker must generate significant traffic volume to overwhelm the target. With HollowByte:
- 11 bytes of payload per request
- Effect: 131 KB of memory allocated server-side, unreleased until restart
- Result: An attacker with a low-bandwidth connection can take down a high-capacity server through accumulation
This type of asymmetry is rare and marks a first-tier vulnerability. Similar mechanics appear in SlowLoris or Billion Laughs XML attacks, but here applied directly to the TLS handshake itself.
Facts vs. analysis
Confirmed facts: flaw in OpenSSL, attack vector via 11-byte TLS request, 131 KB allocated per request on glibc (tested by Okta), patch issued in June without CVE or advisory, memory unreleased until process restart.
Analysis: the silent patch is itself a warning sign—OpenSSL chose to quietly fix a serious vulnerability, meaning many installations remain exposed unknowingly. Updating to the June-fixed version is urgent.
Each malicious 11-byte TLS request forces a vulnerable OpenSSL server to allocate up to 131 KB of memory—memory unreleased until restart. An attacker can multiply requests to exhaust available memory with minimal network throughput.
What to do now
- Check installed OpenSSL version:
openssl version. The HollowByte patch was released in June—verify your deployed version is newer. - Update OpenSSL if not already done: follow security.openssl.org and your distribution’s release notes.
- Check OpenSSL version in Docker images:
docker run <image> openssl version. Images not rebuilt since June are vulnerable. - Enable rate-limiting for TLS connections at the firewall or load balancer, in addition to patching.
- Monitor memory consumption of processes exposing TLS (nginx, apache2, sshd…).
Article produced by artificial intelligence, reviewed under human editorial control.
