As reported by The Hacker News, Okta's Red Team has disclosed a denial-of-service vulnerability in OpenSSL — dubbed HollowByte — that allows an attacker to permanently consume up to 131 KB of server memory per crafted 11-byte TLS request, with no recovery until the process is manually restarted. The fix was silently included in a June OpenSSL release with no CVE identifier, no security advisory, and no changelog annotation to alert defenders.
Why This Flaw Deserves Your Immediate Attention
HollowByte is a textbook example of a low-cost, high-impact denial-of-service primitive. The attacker investment is trivial — 11 bytes. The defender's cost is significant — persistent memory loss that compounds with each crafted request, ultimately starving the process of available memory and degrading or terminating TLS services entirely. On glibc-based Linux systems, the leaked memory is unrecoverable without a process restart, meaning this is not a transient condition that resolves itself.
What makes this particularly dangerous in production environments is the asymmetry: a single attacker with a low-bandwidth connection can systematically degrade a high-traffic TLS termination endpoint, whether that's a web server, API gateway, load balancer, or VPN concentrator. For organizations running OpenSSL at scale — especially those using it for internet-facing HTTPS, mutual TLS (mTLS), or certificate authentication flows — the blast radius is real.
Vulnerability Snapshot
- Vulnerability Name
- HollowByte
- CVE Identifier
- None assigned at time of disclosure
- CVSS / Severity
- Not formally rated; assessed by Shield53 as High based on unauthenticated remote triggering, low attack complexity, and no user interaction required
- Affected Software
- OpenSSL versions prior to the June 2025 patch release (exact version boundary pending full advisory)
- Affected Platforms
- Predominantly glibc-based Linux systems; memory leak behavior confirmed most severe on these configurations
- Patch Available
- Yes — fix shipped in June 2025 OpenSSL release; no formal advisory was published by the OpenSSL project
- Active Exploitation
- Not confirmed in the wild as of disclosure; however, the low complexity of exploitation increases the likelihood of rapid weaponization now that research is public
The Silent Patch Problem Is the Second Story Here
The disclosure process itself warrants scrutiny. OpenSSL shipping a security fix with no CVE, no advisory, and no changelog callout is a significant failure in responsible vulnerability communication. Defenders rely on structured disclosure to prioritize patching. When fixes are buried in routine releases, security teams running risk-based patching programs — which is most mature organizations — have no mechanism to identify that a security-relevant change was made.
A silent patch is an unannounced risk transfer. The vendor resolves their exposure; the defender remains unaware of theirs.
This is not an isolated pattern. We have seen similar behavior across multiple open-source projects, and it consistently disadvantages organizations with large, complex software inventories. If your Software Bill of Materials (SBOM) process doesn't include diffing OpenSSL changelogs at the commit level, you were operationally blind to this fix until Okta's research surfaced it publicly.
Who Is Most at Risk
Shield53 Recommendations
Immediate Actions
- Patch now. Update OpenSSL to the June 2025 release or later across all affected systems. Prioritize internet-facing TLS termination points first.
- Audit your container base images. Many containers pin OpenSSL versions at build time. Force a rebuild of any image using a pre-patch OpenSSL version.
- Inventory OpenSSL usage via SBOM. If you don't have an SBOM, now is the time to generate one. Tools like Syft or SPDX-compatible scanners can identify OpenSSL versions across your software estate.
- Monitor for anomalous memory growth on TLS-serving processes. Establish baseline memory consumption and alert on sustained upward drift without corresponding traffic increases.
- Review rate-limiting controls on TLS handshake initiation at your load balancer or edge layer. This does not eliminate the risk but raises the attacker's cost significantly.
Longer-Term Posture Improvements
- Subscribe to OpenSSL commit feeds or use a vendor that provides structured notifications (e.g., Red Hat, Ubuntu Security Notices) rather than relying solely on upstream changelogs.
- Establish a silent-patch detection process: compare OpenSSL release diffs against your internal patch review cadence, flagging security-keyword commits without corresponding CVEs.
- Evaluate whether your incident response playbooks cover memory exhaustion DoS scenarios for authentication-critical services — many do not.
HollowByte is a reminder that the threat surface of foundational cryptographic libraries extends beyond remote code execution. Availability is a security property, and TLS availability underpins nearly every authenticated service in modern enterprise architecture. Treat this patch with the urgency the OpenSSL project failed to communicate.
