OpenSSL Servers Hit by Critical DoS Flaw, Leaving Them Permanently Bloated with Memory
A severe denial-of-service (DoS) vulnerability has been discovered in OpenSSL, a widely-used library for secure internet communication. Dubbed HollowByte, this flaw allows unauthenticated attackers to trigger a condition that leaves affected servers permanently bloated with memory, rendering them unable to function.
The issue stems from the way vulnerable versions of OpenSSL allocate memory during TLS handshakes. When an attacker sends a malicious payload with a header claiming a larger message body is to follow, the server allocates space for it without validating the data. This process repeats itself as the attacker sends multiple connections, causing the server’s memory to continuously climb.
Okta’s Red Team demonstrated this vulnerability in a real-world scenario using NGINX servers, showing that even low-capacity environments can be depleted of memory with ease. Higher-spec servers may lose up to 25% of their available memory while still below security alerting thresholds.
Although the HollowByte DoS issue is considered less severe than vulnerabilities enabling data theft or code execution, its impact should not be underestimated. Operational disruptions and reputational damage are significant concerns for organizations relying on OpenSSL-embedded software projects such as NGINX and Apache web servers, language runtimes like Node.js and Python, and databases including MySQL and PostgreSQL.
Fortunately, the OpenSSL team has silently fixed this vulnerability by allocating memory only when data arrives, ignoring header claims. This patch is now available in versions 4.0.1, 3.6.3, 3.5.7, 3.4.6, and 3.0.21.
It’s essential for organizations to prioritize upgrading their OpenSSL packages immediately to avoid falling victim to this DoS attack. As Okta emphasizes, the fix is more than just a hardening measure; it’s a crucial update that should be applied as soon as possible.
In light of this vulnerability and others like it, security teams must remain vigilant in testing every layer of their environment before attackers do. Regularly simulating breach and attack scenarios can help identify vulnerabilities and ensure that SIEM and EDR rules are effective in detecting threats. By staying proactive, organizations can mitigate the risk of operational disruptions and reputational damage caused by DoS attacks like HollowByte.
Source: Bleeping Computer — 2026-07-17