A recently discovered vulnerability in the OpenSSL library has left many servers vulnerable to a denial-of-service (DoS) attack that can exhaust their memory before any security handshake even takes place. The issue, dubbed “HollowByte,” affects various types of applications and servers that use OpenSSL, including Apache, NGINX, Node.js, Python, Ruby, PHP, MySQL, PostgreSQL, and others.
The vulnerability exists because older versions of OpenSSL pre-allocate receive buffer sizes based on the incoming message body length declared in the handshake message’s 4-byte header. This means that an attacker can send a malicious payload of just 11 bytes to trigger an unvalidated buffer allocation of up to 131 KB. The worker thread then blocks, waiting indefinitely for data that will never arrive.
But that’s not all – even after the attacker disconnects, the server remains permanently bloated with memory that cannot be reclaimed until the process is terminated. In real-world testing, a 1 GB RAM system became unresponsive after 547 MB of memory was fragmented and frozen. On a 16 GB RAM system, the attack successfully locked up 25% of the system’s total memory while staying safely under the connection ceiling.
The good news is that patches for HollowByte were silently included in OpenSSL version 4.0.1 and backported to versions 3.6.3, 3.5.7, 3.4.6, and 3.0.21. These updates increase the buffer size as bytes actually land and no longer trust the handshake header for buffer growth.
This vulnerability matters because it can be used by attackers to take down servers without even needing to exploit any specific security vulnerabilities. All they need to do is send a malicious payload that exhausts the server’s memory, making it unresponsive. This can have serious consequences for organizations that rely on these servers, including downtime, data loss, and reputational damage.
To stay safe, users are advised to upgrade to the latest version of OpenSSL as soon as possible. This may require some manual intervention, but it’s essential to prevent attacks like HollowByte from taking down your systems. Additionally, administrators should review their server configurations to ensure that they are not vulnerable to this type of attack.
In conclusion, the discovery of HollowByte highlights the importance of keeping software up-to-date and patching vulnerabilities as soon as possible. By doing so, we can reduce the risk of attacks like this one and keep our systems safe from exploitation.
Source: SecurityWeek — 2026-07-20