Tiny TLS Requests Can Drain Server Memory Through Newly Disclosed OpenSSL Flaw

Security researchers have disclosed a newly identified denial-of-service (DoS) vulnerability in OpenSSL that allows attackers to gradually exhaust server memory using specially crafted 11-byte TLS requests, potentially causing affected services to become unavailable.


Dubbed HollowByte, the flaw was discovered by Okta's Red Team and affects servers running vulnerable OpenSSL implementations on glibc-based Linux systems. OpenSSL quietly fixed the issue in June 2026, but the vulnerability was not initially assigned a CVE, included in a security advisory, or highlighted in the project's changelog.


Small Requests Trigger Large Memory Allocations

Researchers found that a malicious client can send a minimal 11-byte TLS packet that forces an affected server to allocate up to 131 KB of memory for data that never arrives.


The allocated memory is not immediately released, allowing repeated requests to steadily consume available resources until the server experiences memory exhaustion and service degradation or crashes. Unlike traditional DoS attacks that rely on high traffic volumes, HollowByte achieves its impact with very small network requests.


Vulnerability Enables Remote Denial-of-Service

Although HollowByte does not allow remote code execution or data theft, attackers can remotely trigger the flaw without authentication, making it a practical denial-of-service threat for internet-facing services that rely on vulnerable OpenSSL versions.
Researchers emphasized that the attack targets availability rather than confidentiality or integrity, potentially disrupting web servers, APIs, VPN gateways, and other TLS-enabled services.


OpenSSL Issued a Silent Fix

The vulnerability was corrected in a June OpenSSL update before public disclosure. However, researchers noted that the fix was released without a dedicated security advisory or CVE assignment, making it easier for organizations to overlook the importance of updating.


Following Okta's public disclosure, administrators are being urged to verify that their OpenSSL deployments include the patched code rather than assuming routine package updates have addressed the issue.


Organizations Should Update Immediately

Security experts recommend that administrators:


- Install the latest patched OpenSSL release.
- Restart services using vulnerable OpenSSL libraries.
- Monitor systems for unusual memory consumption.
- Review exposed TLS services for signs of abuse.
- Prioritize updates on internet-facing infrastructure.


Prompt patching is considered the most effective mitigation, particularly for servers handling large numbers of encrypted connections.


Availability Attacks Continue to Evolve

The disclosure demonstrates that even relatively small implementation flaws in widely deployed cryptographic libraries can create significant operational risks.


As OpenSSL continues to secure a large portion of the internet's encrypted communications, timely updates and continuous monitoring remain essential to protecting critical online services from emerging denial-of-service threats.