A Single 11-Byte Request Could Freeze Your OpenSSL Server Memory

Robert Moore · 2026-07-17

Imagine a single, tiny network request—just 11 bytes—that can make your server freeze up and waste over 131 kilobytes of memory for no reason. That's exactly what the HollowByte flaw does to unpatched OpenSSL servers. And the scary part? The fix was shipped quietly, with no fanfare, no CVE, and no changelog entry. It's like finding out your car had a silent recall that could leave you stranded on the highway. ### What Is HollowByte and Why Should You Care? HollowByte is a denial-of-service (DoS) vulnerability in OpenSSL, the cryptographic library that powers a huge chunk of the internet's secure connections. When an attacker sends a specially crafted 11-byte TLS request, an unpatched server sets aside up to 131 KB of memory waiting for a message that never arrives. On systems using glibc (the GNU C Library), that memory is gone until the server process restarts. That means if you're running a busy web server, this could quickly eat up all available memory, causing crashes or slowdowns. Okta's Red Team discovered the bug and reported it to OpenSSL. The fix was shipped in June, but it didn't get a CVE number, a security advisory, or even a mention in the changelog. This quiet approach means many administrators might not even know they need to update. And that's a problem because the attack is simple to execute—no advanced skills required. ### How Does the Attack Work? Here's the technical bit, broken down simply: - The attacker sends a TLS handshake message that's only 11 bytes long. - The server interprets this as the start of a larger message and allocates memory (up to 131 KB) to receive the rest. - The rest never comes, so the server just sits there, holding that memory hostage. - On glibc systems, this memory is never freed until the process restarts, even after the connection times out. This isn't a memory leak in the traditional sense—it's more like a memory hostage situation. The server sets aside space for a message that's never going to arrive, and it can't let go until it reboots. ### Who Is Affected? If you're running any version of OpenSSL prior to the June patch, you're vulnerable. That includes: - Web servers (Apache, Nginx) - Email servers (Postfix, Dovecot) - VPN services - Any application that uses OpenSSL for TLS connections The bug specifically affects systems using glibc, which includes most Linux distributions. So if you're on Ubuntu, Debian, CentOS, or Red Hat, you need to check your OpenSSL version right now. ### What Should You Do? First, don't panic. The fix is available, and it's a straightforward update. Here's your action plan: 1. **Check your OpenSSL version**: Run `openssl version` in your terminal. If it's older than 3.0.16 or 1.1.1w (depending on your branch), you're vulnerable. 2. **Update immediately**: Use your package manager to upgrade OpenSSL. For example, on Ubuntu: `sudo apt update && sudo apt upgrade openssl`. 3. **Restart services**: After updating, restart any services that use OpenSSL. A full server reboot is safest, but at minimum restart your web server and any TLS-dependent applications. 4. **Monitor for unusual memory usage**: Keep an eye on your server's memory usage. If you see unexplained spikes, it could be a sign of an ongoing attack. ### The Bigger Picture: Why This Matters for Digital Privacy As a digital privacy strategist, I see this as a reminder that even the most trusted tools can have silent vulnerabilities. OpenSSL is everywhere—it's the backbone of HTTPS, secure email, and VPNs. When a flaw like HollowByte goes unadvertised, it puts everyone at risk, especially businesses that rely on uptime and security. The takeaway? Don't assume your software is safe just because you haven't heard about a bug. Regular updates, proactive monitoring, and a healthy dose of skepticism are your best defenses. And if you're running a server, make sure you're on the latest OpenSSL version. A few minutes of maintenance now could save you from hours of downtime later. ### Final Thoughts HollowByte is a reminder that in the world of cybersecurity, the smallest things can cause the biggest headaches. An 11-byte request shouldn't be able to freeze a server, but here we are. The good news is that the fix is simple—update your OpenSSL and move on. Just don't wait until your server starts acting up to do it.