An 11-byte payload is all it takes to trigger permanent memory bloat on an OpenSSL server. Attackers don't need authentication, high bandwidth, or complex exploits. They simply open a TLS connection, claim a massive payload size in a four-byte header, and walk away while the server thread blocks waiting for data that never arrives.
Discovered by Okta's Red Team, the vulnerability dubbed "HollowByte" impacts older OpenSSL releases across Linux distributions, web servers like NGINX and Apache, runtime environments, and enterprise databases. Because OpenSSL serves as the foundational backbone for internet encryption, this memory exhaustion flaw poses an immediate risk to server stability.
An 11-Byte Payload Can Freeze Server Memory
In a typical TLS handshake, every message begins with a 4-byte header. Within that header, a 3-byte length field discloses the size of the handshake data expected to follow. Vulnerable versions of OpenSSL trust this claimed length immediately upon reading the header.
Instead of waiting for the payload body to arrive and verifying its size, the server allocates memory for the full declared size right away. The worker thread then blocks indefinitely, waiting for bytes that the attacker has no intention of sending.
An attacker triggers HollowByte by initiating a TLS connection and sending a tiny 11-byte packet. The packet contains the 4-byte header claiming a huge payload size, followed by minimal data. By opening multiple parallel connections and repeating this process with randomized claimed sizes, an unauthenticated attacker forces the server to allocate vast chunks of memory while sending almost no network traffic.
How HollowByte Explores OpenSSL and Glibc
The true severity of HollowByte stems from how OpenSSL interacts with the underlying system memory manager. When an attacker disconnects, OpenSSL attempts to free the allocated handshake buffers. However, the GNU C Library (glibc) handles memory allocation differently than the application layer.
Rather than immediately returning small-to-medium memory allocations to the host operating system, glibc retains those freed memory chunks for potential future reuse. By launching waves of incoming connections with randomized claimed body sizes, an attacker prevents the glibc memory allocator from effectively reusing those freed chunks.
This pattern fragments the heap heavily. As a result, the server's Resident Set Size (RSS) climbs continuously during the attack. Even after the malicious client disconnects completely and all connections drop, the host server remains permanently bloated. The only way for system administrators to reclaim that leaked memory is by executing a complete process restart.
AI Cybersecurity Threats and Low-Bandwidth Stealth Attacks
During benchmark testing on NGINX web servers, Okta researchers observed that low-capacity environment nodes run out of memory almost immediately under HollowByte probes. Even high-spec servers lost up to 25% of available system memory while total attack bandwidth stayed well below standard security alerting thresholds.
This stealth profile aligns directly with emerging ai cybersecurity threats. Modern threat actors leverage automated AI tools and agentic scripts to launch low-bandwidth micro-burst attacks across target networks. When threat actors integrate automated payloads with ai agent security evasion techniques, traditional network monitoring systems fail to trigger alerts because the traffic volume appears negligible.
As enterprises defend their infrastructure in 2026, low-volume DoS mechanisms present severe operational hurdles. Research published by IBM highlights how unmonitored memory fragmentation can degrade core cloud applications without triggering network intrusion detection rules. For broader context on how evolving threats challenge enterprise defenses, review our detailed report on AI Cybersecurity Threats 2026: Securing Java Infrastructure Against Automated Zero-Day Exploits.
Why Silent Patches Without CVEs Threaten Enterprise Defenses
The OpenSSL project maintainers released fixed versions of the library on June 9, 2026. The patch was included in OpenSSL 4.0.1 and backported to versions 3.6.3, 3.5.7, 3.4.6, and 3.0.21.
However, the maintainers released the fix silently. No Common Vulnerabilities and Exposures (CVE) identifier was assigned, and no public security advisory was issued ahead of the release. The OpenSSL team categorized the update as a routine internal "hardening fix" rather than a critical vulnerability patch.
Silent security fixes create serious blind spots for enterprise defenders. Most automated vulnerability management tools and compliance scanners rely exclusively on CVE databases to flag vulnerable software. Because HollowByte lacks a CVE tracking number, automated scanning pipelines will mark vulnerable OpenSSL instances as compliant. Security teams must actively track non-CVE hardening updates reported by outlets like BleepingComputer to ensure critical servers do not remain exposed.
Securing Infrastructure and Patching OpenSSL in 2026
Remediating the HollowByte flaw requires upgrading OpenSSL across all production systems immediately. The fixed releases modify how the TLS engine handles incoming handshake headers. In fixed versions, OpenSSL grows the internal buffer incrementally as actual data arrives over the socket, ignoring unverified header claims entirely.
Securing host systems requires auditing all software components that rely on OpenSSL. The library is embedded in:
- Web servers such as NGINX and Apache
- Programming language runtimes including Node.js, Python, Ruby, and PHP
- Enterprise database engines like MySQL and PostgreSQL
- Core security toolkits and Linux system utilities
Because many third-party applications bundle statically linked versions of OpenSSL, simply updating system-level package managers may leave embedded instances vulnerable. System administrators must inspect third-party runtimes to verify that all binaries utilize the updated OpenSSL code base. For additional context on enterprise Linux system security, see our report on Microsoft's Linux Defender Update Fails: Two Critical Bugs Leave Systems Unprotected.
Cybersecurity Best Practices for Memory Hardening
To mitigate low-bandwidth denial-of-service vectors, organizations should align their operational procedures with established Cybersecurity Best Practices | Cybersecurity and Infrastructure ... - CISA recommendations. Implementing multi-layered defenses reduces exposure to memory bloat vulnerabilities.
Consider these essential remediation steps:
- Audit OpenSSL Releases: Use an internal systems administration tutorial or automated script to scan servers for OpenSSL versions prior to 4.0.1, 3.6.3, 3.5.7, 3.4.6, and 3.0.21.
- Enforce Process Memory Caps: Configure OS-level resource limits using
systemdcgroups or container limits to prevent a single fragmented process from exhausting host RAM. - Configure Aggressive Timeout Rules: Reduce TLS handshake timeout thresholds on edge proxies so that blocked connection threads terminate quickly before accumulating heap allocations.
- Maintain Dependency Inventories: Build a complete Software Bill of Materials (SBOM) to track embedded OpenSSL libraries within proprietary and commercial applications.
To complement host memory protections, organizations should also examine GitHub and PyPI Add Time-Based Defenses Against Supply Chain Attacks. As Okta's researchers noted in their disclosure recorded by The Hacker News, applying silent hardening patches promptly is vital for protecting infrastructure against memory exhaustion attacks.
