OpenSSL Hollow Byte Flaw Could Freeze Server Memory with 11-Byte TLS Requests
Summary: Okta's Red Team reported a denial-of-service flaw it named HollowByte, in which an 11-byte TLS request makes an unpatched OpenSSL server allocate up to 131 KB for a message body that never arrives, and on glibc systems that memory stays held until the process restarts. OpenSSL shipped the fix in releases dated June 9 (4.0.1, 3.6.3, 3.5.7, 3.4.6, 3.0.21) with no CVE, no advisory, and no changelog entry, and in Okta's NGINX testing a 1 GB server was OOM-killed with 547 MB frozen in fragments while a 16 GB server locked up 25% of system memory.
What's compelling: There is no CVE for a scanner to match and no advisory to read, so a patched Red Hat package still reports the version it was built from and nothing in a normal patch pipeline points you at the June 9 releases. OpenSSL's own triager said he had "not considered any effects possibly coming from glibc," which is the center of Okta's case.
Read the original at The Hacker News ↗
- Mentions
- CVE-2025-66199CVE-2026-34183