OpenSSL HollowByte Flaw Exposes Servers to Memory Exhaustion
A critical OpenSSL vulnerability lets attackers freeze server memory with tiny TLS requests. The flaw affects unpatched servers silently, with no public CVE or advisory issued.
TL;DR
- Attackers can exhaust server memory using only 11-byte TLS requests.
- Each request causes allocation of up to 131 KB with no release until process restart.
- The HollowByte flaw was patched quietly by OpenSSL in June without disclosure.
- Okta's Red Team discovered and reported the denial-of-service vulnerability.
- Organizations should verify OpenSSL versions and monitor for silent patches.
A recently disclosed vulnerability in OpenSSL, dubbed HollowByte, reveals how just eleven bytes in a TLS request can cause unpatched servers to allocate excessive memory. This memory remains locked until the server process restarts, creating a denial-of-service condition that attackers can exploit repeatedly.
The issue was patched by OpenSSL in June but went largely unnoticed, as no CVE, advisory, or changelog entry accompanied the fix. It was only after Okta's Red Team publicly detailed their discovery that the broader impact became clear, especially for systems running glibc where memory behavior exacerbates the flaw.
Technical Impact and Exploitation
- An 11-byte TLS ClientHello triggers allocation of up to 131 KB of server memory.
- Allocated memory is not released until the server process is restarted.
- Repeated requests can rapidly exhaust available system memory.
- The flaw primarily impacts servers using OpenSSL versions prior to the June patch.
- Systems using glibc are particularly vulnerable due to memory management specifics.
Silent Patch Raises Security Concerns
- OpenSSL released the fix in version updates without public disclosure.
- No CVE or security advisory was issued for the HollowByte vulnerability.
- This lack of transparency complicates vulnerability tracking and patch verification.
- Okta's Red Team identified and named the flaw after discovering the behavior.
- Security teams are advised to audit OpenSSL versions and monitor for undocumented fixes.
Sources
Sources
Security email updates
One digest email when we publish new security articles (TL;DR plus links to read more). Unsubscribe anytime from the message footer. See our Privacy Policy.