--- title: HollowByte DDoS flaw bloats OpenSSL server memory with... description: A vulnerability called HollowByte enables unauthenticated attackers to trigger a denial-of-service condition on OpenSSL servers using just an 11-byte malicious... canonical: https://daily.dev/posts/hollowbyte-ddos-flaw-bloats-openssl-server-memory-with-11-byte-payload-059vg19vt twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: HollowByte DDoS flaw bloats OpenSSL server memory with 11-byte payload | daily.dev og:description: A vulnerability called HollowByte enables unauthenticated attackers to trigger a denial-of-service condition on OpenSSL servers using just an 11-byte malicious... og:url: https://daily.dev/posts/hollowbyte-ddos-flaw-bloats-openssl-server-memory-with-11-byte-payload-059vg19vt og:image: https://api.daily.dev/og/posts/059VG19vT.png og:image:alt: HollowByte DDoS flaw bloats OpenSSL server memory with 11-byte payload og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # HollowByte DDoS flaw bloats OpenSSL server memory with 11-byte payload **[BleepingComputer](https://daily.dev/sources/bleepingcomputer)** · 3 min read · 1 upvotes · 0 comments ## Summary A vulnerability called HollowByte enables unauthenticated attackers to trigger a denial-of-service condition on OpenSSL servers using just an 11-byte malicious payload. The flaw exploits how OpenSSL allocates memory based on a TLS handshake header's declared message size before the actual payload arrives, causing worker threads to block indefinitely. Combined with glibc's memory handling behavior, repeated waves of connections with randomized claimed sizes cause heap fragmentation and permanent RSS bloat — even after the attacker disconnects. Tests on NGINX showed high-spec servers can lose up to 25% of memory while attack traffic stays below alerting thresholds. The OpenSSL team silently patched the issue in versions 4.0.1, 3.6.3, 3.5.7, 3.4.6, and 3.0.21. Okta, which discovered and disclosed the flaw, recommends immediate upgrade of OpenSSL packages. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What is the HollowByte vulnerability in OpenSSL and how does it work? HollowByte is a denial-of-service flaw where vulnerable OpenSSL versions allocate memory based on a TLS handshake message's declared 4-byte length header before validating that the actual payload arrives. An attacker sends an 11-byte input claiming a much larger message body will follow, causing the worker thread to block indefinitely waiting for data that never arrives, while memory allocation persists. _daily.dev surfaces vulnerability writeups like this for teams patching TLS stacks before attackers exploit them._ ### Which OpenSSL versions fix the HollowByte DoS vulnerability? The HollowByte issue is fixed in OpenSSL 4.0.1 and backported to 3.6.3, 3.5.7, 3.4.6, and 3.0.21. These versions now grow the buffer only when data actually arrives instead of trusting the header's claimed size, closing the memory-bloat path. Okta recommends upgrading distribution OpenSSL packages immediately even though it was classified as a hardening fix rather than a formal CVE. _track OpenSSL patch versions on daily.dev when planning upgrades across production servers._ ### Why does OpenSSL's HollowByte flaw cause permanent memory bloat on servers even after an attack stops? Repeated connections with randomized claimed message sizes fragment the heap because glibc does not immediately return small-to-medium freed allocations to the operating system, keeping them for potential reuse instead. This prevents the allocator from reusing freed chunks, so the server's resident set size climbs continuously and the bloat persists even after the attacker disconnects, requiring a process restart to reclaim memory. _daily.dev keeps infrastructure teams current on memory-safety issues affecting widely embedded libraries like OpenSSL._ ## Similar posts on daily.dev - [Nginx, Apache, and more hit by DoS attack exploiting flaw in HTTP/2](https://daily.dev/posts/nginx-apache-and-more-hit-by-dos-attack-exploiting-flaw-in-http-2-lrfkdbwpy) · CSO Online · 0 upvotes · 0 comments - [Vulnerabilities](https://daily.dev/posts/vulnerabilities-y7s3glgjt) · Lobsters · 0 upvotes · 0 comments - [New 'HTTP/2 Bomb' DoS attack crashes web servers in under a minute](https://daily.dev/posts/new-http-2-bomb-dos-attack-crashes-web-servers-in-under-a-minute-u9xatkol2) · BleepingComputer · 13 upvotes · 0 comments - [libssh2 CVE-2026-55200 Shows Why Outbound SSH Is an Attack Surface](https://daily.dev/posts/libssh2-cve-2026-55200-shows-why-outbound-ssh-is-an-attack-surface-pza5y7nfo) · Latest Hacking News · 1 upvotes · 0 comments --- Tags: [#cyber](https://daily.dev/tags/cyber), [#vulnerability](https://daily.dev/tags/vulnerability), [#cryptography](https://daily.dev/tags/cryptography) [View this post on daily.dev](https://daily.dev/posts/hollowbyte-ddos-flaw-bloats-openssl-server-memory-with-11-byte-payload-059vg19vt) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"HollowByte DDoS flaw bloats OpenSSL server memory with 11-byte payload","url":"https://daily.dev/posts/hollowbyte-ddos-flaw-bloats-openssl-server-memory-with-11-byte-payload-059vg19vt","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/hollowbyte-ddos-flaw-bloats-openssl-server-memory-with-11-byte-payload-059vg19vt"},"datePublished":"2026-07-17T17:56:40.662Z","dateModified":"2026-09-14T08:45:21.062Z","description":"A vulnerability called HollowByte enables unauthenticated attackers to trigger a denial-of-service condition on OpenSSL servers using just an 11-byte malicious...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/8c3a23bf949d51d4c6c03f6ddc441c7b?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/8c3a23bf949d51d4c6c03f6ddc441c7b?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"BleepingComputer","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"BleepingComputer","logo":"https://media.daily.dev/image/upload/s--as8nJ3qy--/f_auto,q_auto/v1774959951/logos/bleepingcomputer?_a=BAMAMiWQ0","url":"https://daily.dev/sources/bleepingcomputer"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/hollowbyte-ddos-flaw-bloats-openssl-server-memory-with-11-byte-payload-059vg19vt","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":1},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"cyber,vulnerability,cryptography","timeRequired":"PT3M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"BleepingComputer","item":"https://daily.dev/sources/bleepingcomputer"},{"@type":"ListItem","position":3,"name":"HollowByte DDoS flaw bloats OpenSSL server memory with 11-byte payload"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/hollowbyte-ddos-flaw-bloats-openssl-server-memory-with-11-byte-payload-059vg19vt#faq","mainEntity":[{"@type":"Question","name":"What is the HollowByte vulnerability in OpenSSL and how does it work?","acceptedAnswer":{"@type":"Answer","text":"HollowByte is a denial-of-service flaw where vulnerable OpenSSL versions allocate memory based on a TLS handshake message's declared 4-byte length header before validating that the actual payload arrives. An attacker sends an 11-byte input claiming a much larger message body will follow, causing the worker thread to block indefinitely waiting for data that never arrives, while memory allocation persists. daily.dev surfaces vulnerability writeups like this for teams patching TLS stacks before attackers exploit them."}},{"@type":"Question","name":"Which OpenSSL versions fix the HollowByte DoS vulnerability?","acceptedAnswer":{"@type":"Answer","text":"The HollowByte issue is fixed in OpenSSL 4.0.1 and backported to 3.6.3, 3.5.7, 3.4.6, and 3.0.21. These versions now grow the buffer only when data actually arrives instead of trusting the header's claimed size, closing the memory-bloat path. Okta recommends upgrading distribution OpenSSL packages immediately even though it was classified as a hardening fix rather than a formal CVE. track OpenSSL patch versions on daily.dev when planning upgrades across production servers."}},{"@type":"Question","name":"Why does OpenSSL's HollowByte flaw cause permanent memory bloat on servers even after an attack stops?","acceptedAnswer":{"@type":"Answer","text":"Repeated connections with randomized claimed message sizes fragment the heap because glibc does not immediately return small-to-medium freed allocations to the operating system, keeping them for potential reuse instead. This prevents the allocator from reusing freed chunks, so the server's resident set size climbs continuously and the bloat persists even after the attacker disconnects, requiring a process restart to reclaim memory. daily.dev keeps infrastructure teams current on memory-safety issues affecting widely embedded libraries like OpenSSL."}}]} ```