OPENSSL’S newly disclosed HollowByte flaw lets attackers trigger a denial of service with just eleven bytes of malicious data, a weakness uncovered by Okta’s Red Team in their advisory. The issue affects any service that relies on vulnerable OpenSSL releases, including widely used web servers such as Apache and NGINX. Patched versions have been released, and administrators are urged to update immediately.
The vulnerability stems from how older OpenSSL versions allocate memory based on the size field presented in a handshake message before validating the actual data. An attacker can send a tiny packet that claims a large size, causing the library to reserve a huge buffer that is never filled. This leads to rapid memory exhaustion and can force the affected process to crash or become unresponsive.
Any deployment using OpenSSL releases prior to the fixes is at risk, particularly those running Apache httpd or NGINX as front‑ends. The OpenSSL project has issued version 4.0.1 containing the fix and has backported the patch to the 3.6.3, 3.5.7, 3.4.6 and 3.0.21 branches. Systems that remain on older builds should upgrade to one of these patched releases as soon as possible.
To date, no threat actors have been observed exploiting HollowByte in the wild, and the Okta team notes that the flaw requires only network access to the target service. Despite the lack of confirmed attacks, the ease of triggering the condition with a minimal payload means that unpatched installations could be disrupted quickly if the technique becomes known.
Defenders should first verify the OpenSSL version in use with commands such as openssl version or by checking package manager output. If the version is older than the patched releases, the appropriate update must be applied and the affected services restarted to load the new library. After updating, administrators ought to monitor memory usage and server logs for any abnormal spikes that could indicate an attempted attack.
In addition to patching, organisations should maintain an accurate inventory of all systems that depend on OpenSSL and prioritize those that are internet‑facing. Testing the update in a staging environment before rollout can help avoid unexpected compatibility issues. Finally, consider disabling any unused TLS features or cipher suites that might increase the attack surface, while keeping an eye on future advisories from the OpenSSL project.