OpenSSL HollowByte Flaw Could Freeze Server Memory with 11-Byte TLS Requests

2026-07-20

HollowByte allows an attacker to send tiny TLS handshakes that cause OpenSSL to allocate up to 131 KB per connection, leaving that memory stranded on glibc systems until a restart. OpenSSL silently fixed it on June 9 across multiple branches without a CVE, so scanners miss it, and downstream backports are hard to track. Okta reported NGINX servers losing hundreds of megabytes to fragmented heaps.