Security researchers at Okta Security have disclosed a denial-of-service vulnerability in OpenSSL, dubbed Hollowbyte. Attackers can exploit it to overwhelm the working memory of web servers and other systems. Packets as small as eleven bytes are enough, and no authentication is required.
How the Attack Works
The issue lies in the TLS handshake. Initial Client Hello messages carry a 4-byte header that declares the size of the incoming message body. Older OpenSSL versions pre-allocate receive buffer memory based on this declared size, before any actual data arrives. An attacker can trigger this allocation in a loop with 11-byte payloads, reserving up to 131 KB per request.
The allocated memory stays blocked as long as the worker thread waits for data that never arrives. A further trick involving the GNU C Library (Glibc) keeps memory occupied even after the connection drops, because Glibc caches small allocations rather than returning them to the OS immediately. Using this method, researchers were able to completely exhaust a Nginx server with just 1 GB of RAM.
Patch Available Since June
The flaw is fixed in OpenSSL 4.0.1, released on June 9. The updated version no longer trusts the declared header size and only grows the receive buffer as actual data arrives. Backports are available for versions 3.6.3, 3.5.7, 3.4.6, and 3.0.21. Beyond Nginx and Apache, many other packages embed OpenSSL and are equally at risk, including Node.js, Python, Ruby, PHP, MySQL, and PostgreSQL. Developers should update their projects to a patched version without delay.