Home · Wiki · Vulnerabilities & CVEs

type: cve · created: 2026-07-17 · updated: 2026-08-18 · tags: [cve-less, vulnerability, openssl, tls, denial-of-service, memory-leak] · confidence: high · severity: not-rated · affected_sectors: [] · au_impact: true

OpenSSL HollowByte Flaw

HollowByte is a denial-of-service vulnerability in OpenSSL where an 11-byte TLS handshake message causes the server to allocate up to 131 KB of memory per request that is never reclaimed until process restart.

Discovered by: Okta Red Team
No CVE assigned, no advisory published — the fix was silently shipped
Fixed releases: OpenSSL 4.0.1, 3.6.3, 3.5.7, 3.4.6, 3.0.21 (all dated June 9, 2026)

Technical Details

Every TLS handshake message carries a 4-byte header, three bytes of which declare the body length. Older versions grew the receive buffer to that declared size the moment the header landed, before receiving any body bytes. An 11-byte request (4-byte header + 7 declared bytes) triggers allocation of up to 131 KB. On glibc systems, this memory is never returned until the process restarts.

Mitigation

Upgrade to the fixed OpenSSL releases listed above. Because no CVE or advisory was published, routine patch scanners will not flag affected versions.

References

Okta Red Team public disclosure (2026-07-17)
The Hacker News coverage

Provenance

2026-07-17: Okta Red Team disclosed details. The fix was shipped June 9 without public advisory.