OpenSSL DoS Vulnerability Lets Remote Attackers Exhaust Server Memory With an 11

Gbhackers •Eswar • July 18, 2026

A newly disclosed vulnerability reminds us how deeply our digital infrastructure relies on foundational libraries. The Okta Red Team recently discovered “HollowByte,” a Denial of Service (DoS) flaw in OpenSSL that allows a remote, unauthenticated attacker to force a server to allocate disproportionate memory chunks before any security handshake even begins, using a payload just […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

HollowByte Vulnerability in OpenSSL Allows DoS with 11-Byte Payload The HollowByte vulnerability in OpenSSL enables unauthenticated attackers to trigger a denial-of-service (DoS) condition using a malicious payload of just 11 bytes. Discovered by Okta's Red Team, this flaw exploits how OpenSSL handles memory allocation during the TLS handshake. Vulnerable versions allocate memory based on the declared size in the handshake header before validating the actual data. This can lead to significant memory exhaustion, as the server may reserve large memory chunks for unfulfilled connections. The issue affects widely used software that relies on OpenSSL, including web servers like NGINX and Apache, as well as various language runtimes and databases. The OpenSSL team has released a fix, silently included in version 4.0.1 and backported to older versions. Organizations are advised to update to the patched versions to mitigate the risk. Although DoS vulnerabilities are typically less severe than those allowing data theft, they can still cause operational disruptions. 10 sources 58

Extracted Entities

OpenSSL DoS Vulnerability Lets Remote Attackers Exhaust Server Memory With an 11

The full story

Extracted Entities

Attack Types (1)

Companies (1)

CWE Weaknesses (1)

Tools (1)

Vulnerabilities (1)