This 11-Byte TLS Request Could Quietly Freeze Your Server Memory

Emily Davis · 2026-07-17

You wouldn't think eleven tiny bytes of data could bring a server to its knees. But that's exactly what a newly discovered flaw in OpenSSL can do. It's called HollowByte, and it's the kind of bug that slips through the cracks, even in software we all trust. Here's the scary part: an unpatched OpenSSL server, when hit with a specific 11-byte TLS request, will set aside up to 131 KB of memory for a message that never arrives. On glibc systems tested by Okta's Red Team, that memory is gone until you restart the entire process. No recovery. No timeout. Just a slow, silent leak. ### The Silent Leak Imagine you're running a busy online store or a critical API server. HollowByte doesn't crash your system outright. Instead, it slowly eats away at your memory. Each request might only take 131 KB, but when you're serving thousands of connections, those bytes add up fast. Before you know it, your server starts swapping, response times crawl, and users start seeing errors. The worst part? OpenSSL shipped the fix for HollowByte back in June, but they did it without a CVE, without an advisory, and without a changelog entry pointing at it. That means most sysadmins never knew they needed to update. It's like finding out your car had a recall but the manufacturer never sent you a letter. ### What Makes HollowByte So Dangerous? - **Small payload, big impact:** Just 11 bytes of data can trigger a 131 KB memory allocation that never frees up. - **Silent deployment:** The fix was included in a regular update with no fanfare. If you're not running the absolute latest version, you're vulnerable. - **No crash, just a crawl:** This isn't a denial-of-service that takes you offline immediately. It's a slow bleed that degrades performance over time, making it hard to diagnose. ### How to Protect Yourself If you're using OpenSSL, you need to act now. Here's what to do: - **Update immediately:** Make sure you're running the latest version of OpenSSL. The fix was included in the June release, so anything older is at risk. - **Monitor memory usage:** Keep an eye on your server's memory metrics. If you see unexplained increases, HollowByte could be the culprit. - **Restart regularly:** If you can't update right away, schedule periodic restarts of your services to clear any leaked memory. ### The Bigger Picture HollowByte is a wake-up call for anyone running critical infrastructure. It shows that even the most trusted software can have hidden vulnerabilities. And it highlights the importance of staying on top of updates, even when they don't come with flashy announcements. Okta's Red Team deserves credit for finding and reporting this bug. But the real lesson here is that security isn't just about patching known vulnerabilities. It's about being proactive. It's about asking questions when updates are silent. And it's about understanding that sometimes, the most dangerous threats are the ones that never make the headlines. > "Eleven bytes will make an unpatched OpenSSL server set aside up to 131 KB of memory for a message that never arrives." - Okta Red Team This isn't just a technical footnote. It's a reminder that in the world of cybersecurity, size doesn't matter. A tiny request can cause massive damage. So check your servers. Update your software. And don't let HollowByte freeze your memory.