# Critical OpenSSL Vulnerability Allows Memory Exhaustion via TLS Requests

*Published July 20, 2026*
*Source: [https://thehackernews.com/2026/07/openssl-hollowbyte-flaw-could-freeze.html](https://thehackernews.com/2026/07/openssl-hollowbyte-flaw-could-freeze.html)*

## Executive Summary

A vulnerability in OpenSSL, called HollowByte, allows an attacker to exhaust server memory with an 11-byte TLS request, causing denial of service. The fix was released without a CVE or advisory, complicating detection and remediation efforts.

## Article

A significant vulnerability named HollowByte has been identified in OpenSSL, allowing an attacker to exploit server memory through an innocuous-looking 11-byte TLS request. This flaw can cause a server to allocate up to 131 KB of memory for a message that is never completed, effectively leading to a denial-of-service condition until the server is restarted. The issue is exacerbated on systems using glibc, where memory allocated by OpenSSL is not immediately returned to the kernel, resulting in fragmented memory and substantial memory usage over time. 

Okta's Red Team discovered and named the HollowByte vulnerability, which was quietly fixed by OpenSSL in June with releases 4.0.1, 3.6.3, 3.5.7, 3.4.6, and 3.0.21. However, the fix was not accompanied by a CVE, advisory, or changelog entry, leaving many users unaware of the potential impact. This lack of formal documentation means that standard patch pipelines may not detect the issue, complicating efforts to secure affected systems. 

The vulnerability stems from the trust placed in the attacker's declaration of message size during the TLS handshake process. Previous versions of OpenSSL expanded the receive buffer based on this declaration before any message body was actually received. While the OpenSSL team has addressed the issue by categorizing it as a 'bug or hardening' fix, it raises questions about the prioritization and communication of such vulnerabilities. 

In testing conducted by Okta, a 1 GB server was overwhelmed with 547 MB of memory locked in fragments, and a 16 GB server saw 25% of its memory consumed without breaching connection limits. Despite the severity of the issue, no public proof-of-concept exploit code has been found as of mid-July. Users running upstream builds have received the fix, but downstream users may face challenges due to the lack of a CVE identifier. 

To mitigate this issue, administrators should ensure they are running the latest OpenSSL versions and verify with package maintainers whether the June 9 patch was implemented. The fix currently only addresses TLS, while DTLS remains unaffected due to its more complex nature, as noted by the patch's author, Matt Caswell.