A recently discovered vulnerability in OpenSSL, a widely-used cryptographic library, could allow attackers to freeze server memory with just an 11-byte TLS request. The flaw, dubbed HollowByte, affects all versions of OpenSSL from 1.0.2 to 3.0 and has been patched in the latest update.
The issue arises when an attacker sends a specially crafted TLS (Transport Layer Security) handshake packet that is only 11 bytes long. This triggers a buffer overflow in the OpenSSL library, causing it to allocate excessive amounts of memory for processing the request. As more requests are made, the server’s available memory dwindles until it reaches its limit, leading to a freeze.
The vulnerability affects any system using OpenSSL, including Linux and Windows servers, as well as applications like Apache HTTP Server and Nginx. According to OpenSSL’s own estimate, millions of servers worldwide rely on their library for secure communication. It is likely that many organizations will need to apply the latest patches to prevent exploitation.
OpenSSL uses a technique called “double-free” memory allocation to manage TLS connections. When an attacker sends a malicious request, the library attempts to allocate additional memory to process the handshake. However, the 11-byte packet bypasses this mechanism, causing OpenSSL to create multiple memory allocations without freeing the previous ones. As more requests are made, these duplicate allocations continue to build up until the server runs out of available memory.
The HollowByte vulnerability is notable for its simplicity and low bar for exploitation. With just an 11-byte packet, an attacker can freeze a server’s memory, potentially leading to denial-of-service (DoS) attacks or even allowing them to inject malicious code into the system. Given the widespread use of OpenSSL, it’s essential that administrators take immediate action to update their libraries and prevent potential attacks.
To protect against this vulnerability, organizations should immediately apply the latest patches from OpenSSL and ensure all dependent applications are updated accordingly. Additionally, implementing a robust logging mechanism can help detect and respond to any potential attempts at exploitation.
Source: The Hacker News — 2026-07-17