A vulnerability dubbed HollowByte allows unauthenticated attackers to trigger a denial-of-service condition on OpenSSL servers with a malicious payload of just 11 bytes. The flaw, discovered by Okta’s Red Team, causes unpatched OpenSSL servers to allocate up to 131 KB of memory for each crafted TLS request, with that memory never released on glibc systems until the process restarts.
OpenSSL shipped the fix in June 2026 with no CVE number, no advisory, and no changelog entry, making it difficult for administrators to know they needed to update. Okta, which reported the bug, published technical details after giving OpenSSL maintainers reasonable time to address the issue.
The vulnerability affects all applications using the affected versions of the OpenSSL library, including web servers, VPN gateways, email servers, and network appliances. A sustained attack could exhaust server memory, causing crashes or complete denial of service. The small payload size makes the attack difficult to detect through standard network monitoring.
Organizations relying on OpenSSL are advised to ensure they are running the latest patched version. The incident highlights ongoing challenges in vulnerability disclosure for critical infrastructure libraries, where silent fixes can leave downstream users unaware of security risks. As reported by Bleeping Computer and The Hacker News, HollowByte is a reminder to keep cryptographic libraries updated.
