Back Feeds.4Sysops

HollowByte flaw allows unauthenticated OpenSSL memory exhaustion

Feeds.4Sysops •IT News • July 17, 2026

A newly discovered vulnerability named HollowByte allows unauthenticated attackers to trigger a denial-of-service condition on OpenSSL servers using a payload of only 11 bytes. The flaw stems from how the library handles TLS handshake headers, which contain a field declaring the size of the incoming message body. Vulnerable versions trust this header and allocate the requested memory immediately before the actual data arrives or is validated. Source

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

HollowByte Vulnerability in OpenSSL Allows DoS with 11-Byte Payload The HollowByte vulnerability in OpenSSL enables unauthenticated attackers to trigger a denial-of-service (DoS) condition using a malicious payload of just 11 bytes. Discovered by Okta's Red Team, this flaw exploits how OpenSSL handles memory allocation during the TLS handshake. Vulnerable versions allocate memory based on the declared size in the handshake header before validating the actual data. This can lead to significant memory exhaustion, as the server may reserve large memory chunks for unfulfilled connections. The issue affects widely used software that relies on OpenSSL, including web servers like NGINX and Apache, as well as various language runtimes and databases. The OpenSSL team has released a fix, silently included in version 4.0.1 and backported to older versions. Organizations are advised to update to the patched versions to mitigate the risk. Although DoS vulnerabilities are typically less severe than those allowing data theft, they can still cause operational disruptions. 10 sources 58

Extracted Entities

HollowByte flaw allows unauthenticated OpenSSL memory exhaustion

The full story

Extracted Entities

Attack Types (1)

CWE Weaknesses (1)

Tools (1)

Vulnerabilities (1)