OpenSSL HollowByte Flaw Could Freeze Server Memory with 11-Byte TLS Requests

[Starburst-David]

openssl-hollowbyte-flaw.jpg (241.55 KiB) Viewed 517 times

Eleven bytes will make an unpatched OpenSSL server set aside up to 131 KB of memory for a message that never arrives. On the glibc systems Okta tested, that memory is gone until the process restarts.

OpenSSL shipped the HollowByte fix in June with no CVE, no advisory, and no changelog entry pointing at it. Okta's Red Team, which reported the denial-of-service bug and named it, published the details on Thursday.

The fixed releases are OpenSSL 4.0.1, 3.6.3, 3.5.7, 3.4.6, and 3.0.21, all dated June 9. Every release on those branches before the fixed ones has it. Nothing in a normal patch pipeline will point you at them: there is no identifier for a scanner to match and no advisory to read.

Full article can be found at:
https://thehackernews.com/2026/07/opens ... reeze.html

Published Date: Jul 17, 2026

Vulnerabilities has been mentioned in this article:
CVE-2026-34183 CVE-2025-66199