HollowByte: A Vulnerability Dubbed HollowByte Allows Unauthenticated Attackers to Trigger a
You think you’re safe because your OpenSSL version is "up to date." You’ve patched the CVEs. You’ve scanned the binaries. You’ve got your SOC alerts tuned. But HollowByte? It doesn’t care about any of that.
This isn’t a buffer overflow. It’s not a remote code execution. It’s worse. It’s a quiet, surgical sabotage of memory — a 11-byte payload that turns your server into a ghost that keeps consuming RAM long after the attacker’s gone. And if you’re running NGINX, Apache, or even a Node.js app on Linux? You’re already exposed.
Okta’s Red Team didn’t find this by accident. They were looking for the kind of flaw that slips through vulnerability scanners because it doesn’t leave a footprint. And they found it: OpenSSL, the bedrock of HTTPS, trusts a packet’s claim about its own size — and allocates memory before ever checking if the data arrives.
That’s the heart of HollowByte. An attacker sends a TLS handshake with a 4-byte header saying, "I’m sending 100MB of data." Then they send 11 bytes total — and vanish. The server waits. And waits. And allocates. And fragments.
The GNU C Library doesn’t give that memory back. Not immediately. Not ever, really. It holds onto it "for potential reuse." So while your server’s CPU is idle, its RAM climbs. And climbs. Until your 16GB instance is choking on 14GB of phantom allocations. And no restart? No graceful shutdown? Nothing. You have to kill the process. Full stop.
This isn’t a theoretical risk. Okta tested it on NGINX. Low-end boxes went down in minutes. High-end ones? Lost 25% of memory — and the attack traffic was so low, it didn’t even trigger a DDoS alert.
You’re not being hacked. You’re being starved.
And the fix? It’s not glamorous. OpenSSL didn’t label it a CVE. They called it a "hardening fix." They backported it to 3.0.21, 3.4.6, 3.5.7, 3.6.3, and 4.0.1. But if your distro hasn’t updated its OpenSSL package? You’re still bleeding.
So ask yourself: when was the last time you checked your OpenSSL version? Not the version your package manager says it is — the actual version your web server is running? Because if you’re still on 3.0.19? You’re running a ghost.
This isn’t about patching. It’s about trust. And OpenSSL, for decades, has been the one thing we trusted without question. HollowByte proves that trust was misplaced.
You don’t need a zero-day to break your infrastructure. Sometimes, you just need a 11-byte lie.
How HollowByte Turns Memory Into a Trap
Let’s break this down. Not as a developer. Not as a security engineer. As someone who’s had to reboot a server at 3 a.m. because the RAM usage chart looked like a mountain range.
TLS handshakes start with a handshake header. Four bytes. Three of them tell the server: "Here’s how big the next message is." The server reads that number — say, 1,048,576 bytes — and immediately allocates that much memory. It doesn’t wait. It doesn’t verify. It doesn’t ask.
It just… trusts.
Then the attacker sends 11 bytes. That’s it. Not 1MB. Not 100KB. Eleven. The server sits there, waiting for the rest. The worker thread blocks. The memory is locked. And because the connection never completes, the buffer never gets filled.
Now, here’s the kicker: OpenSSL frees that buffer when the connection drops. So far, so good, right?
Wrong.
Because the GNU C Library — glibc — doesn’t return small-to-medium allocations to the OS. It keeps them in a pool. For reuse. That’s fine… unless someone’s flooding your server with 500 connections per second, each claiming a different size.
Suddenly, your heap is a mosaic of 500 tiny, unusable chunks. The allocator can’t coalesce them. It can’t reuse them. So it keeps allocating new ones. Your RSS climbs. Your swap fills. Your performance tanks.
And the attacker? They’re gone. The connection’s closed. The attack’s over. But your server? It’s still bloated. Forever. Until you kill the process.
This isn’t a denial-of-service. It’s a memory poisoning. And it’s silent.
Most tools won’t flag it. Your SIEM won’t see the spike as malicious. Your DDoS mitigation? It’s designed for traffic floods, not tiny, perfectly legal TLS packets.
The only sign? A server that’s running fine — CPU at 12%, network idle — but RAM usage is at 95%. And it keeps climbing. Even after you reboot. Wait — no. Even after you reboot, if you restart the same service with the same OpenSSL version? It’ll happen again.
This is the worst kind of vulnerability: one that doesn’t break. It just slowly, quietly, breaks your ability to function.
And the fix? You need to upgrade. Not to a "patch." Not to a "security update." To a version that ignores the header’s claim and only allocates when the data arrives. That’s OpenSSL 3.0.21 and above. If you’re on 3.0.19? You’re still vulnerable.
Check your version. Not the package manager. The running binary. Run openssl version. If it says 3.0.19? You’re not patched. You’re just pretending.
Why Your Patch Management Is Already Too Late
You’ve got a patch management system. You’ve got automated scans. You’ve got runbooks. You’ve got tickets.
None of it matters.
Because HollowByte doesn’t care about your process. It doesn’t care if you’re using Ansible or Chef or Puppet. It doesn’t care if you’ve got a 30-day patch window. It doesn’t care if your compliance team says OpenSSL is "in scope."
It only cares that you’re still running an old version.
And here’s the dirty truth: most organizations are.
Why? Because OpenSSL is everywhere. Embedded in NGINX. In Apache. In Python’s urllib. In Ruby’s OpenSSL gem. In your Kubernetes ingress controller. In your CI/CD pipeline’s TLS termination. In your database’s encrypted connections.
You don’t manage OpenSSL. You manage the service that uses it. And if your service hasn’t been restarted since the last system update? You’re still running the old OpenSSL.
I’ve seen it. A company with a perfect patching record. All their systems scanned weekly. All CVEs patched. But their Redis instances? Still on OpenSSL 3.0.17. Because the Redis service hadn’t been restarted in 18 months. The update was there. The package was upgraded. But the process? Still running the old binary.
HollowByte doesn’t need a CVE number. It doesn’t need a CVSS score. It just needs you to be lazy.
And here’s the worst part: you can’t detect it after the fact.
No SIEM rule will catch a 11-byte TLS packet. No EDR will flag a memory allocation spike as malicious. Your vulnerability scanner? It checks package versions — not running binaries. And if you’re lucky, it’ll tell you the package is updated. But it won’t tell you if the service is still using the old version.
So what do you do?
You don’t wait for a patch. You don’t wait for a scan. You don’t wait for an alert.
You restart everything.
Every web server. Every API gateway. Every database connection pool. Every container. Every Lambda function that uses TLS. You restart them all. And then you verify. Not with openssl version on the host — with lsof -p <pid> | grep libssl on the running process. If it’s still pointing to libssl.so.3.0.19? You haven’t fixed it.
This isn’t a vulnerability. It’s a cultural failure. We treat OpenSSL like a black box. We assume it’s safe. We don’t audit it. We don’t monitor it. We don’t restart the services that use it.
HollowByte didn’t exploit OpenSSL. It exploited our arrogance.
And if you’re still running OpenSSL 3.0.19? You’re not just vulnerable. You’re complicit.
The Real Lesson: Trust No One — Not Even OpenSSL
I used to think the real threat was the hacker with the exploit kit. The script kiddie with the DDoS botnet. The APT with the zero-day.
I was wrong.
The real threat is the thing we trust without question.
OpenSSL has been the silent guardian of the internet for 25 years. We built our entire digital infrastructure on it. We embedded it in firewalls, routers, cloud services, mobile apps. We assumed it was bulletproof.
And then HollowByte happened.
Not because the code was badly written. Not because someone slipped in a backdoor. But because the design assumed trust. The server believed the client. The client said, "I’m sending 100MB." The server said, "Okay, here’s 100MB of memory." And that was it.
No validation. No bounds check. No timeout. Just trust.
And that’s the lesson.
In security, trust is the most dangerous assumption.
We trust our firewalls. We trust our MFA. We trust our cloud providers. We trust our vendors. We trust our patches.
But HollowByte shows us: trust is a vulnerability.
You don’t need a new tool. You don’t need a new policy. You need a new mindset.
Verify everything. Even the things you’ve trusted for decades.
Check your OpenSSL version — not on the package manager, but on the running process.
Restart your services. Even if they’re "working fine."
Monitor memory usage like it’s your last line of defense.
And when you hear about a "hardening fix"? Don’t shrug. Don’t wait for a CVE. Patch it. Now.
Because the next HollowByte isn’t coming from a hacker.
It’s coming from the thing you thought was safe.
And you’re the one who’s going to have to reboot the server when it breaks.