OpenSSL HollowByte Flaw Could Freeze Server Memory with 11-Byte TLS Requests

A critical memory exhaustion flaw in OpenSSL could allow attackers to freeze server resources using just 11 bytes of malicious TLS traffic. The issue, dubbed HollowByte, affects older versions of OpenSSL and was quietly patched in June without a CVE identifier or official advisory. Affected versions include all prior releases before OpenSSL 4.0.1, 3.6.3, 3.5.7, 3.4.6, and 3.0.21. The vulnerability allows attackers to exhaust server memory by tricking the software into allocating large buffers based on forged message lengths. This can lead to out-of-memory conditions even without hitting connection limits. OpenSSL classified the fix as a 'bug or hardening' change, meaning it did not receive a formal security rating or public tracking. However, Okta's Red Team warns that standard defenses like rate limiting will not prevent this attack due to how glibc manages memory. Users are advised to update to the latest stable versions immediately.