Okta's HollowByte: 11-byte DoS and the Silent Patch Problem

Just read the Okta Red Team report on "HollowByte." It’s frustrating that we’re seeing these critical memory leaks get patched silently with zero CVEs. For those who missed it, a specifically crafted 11-byte TLS request forces an unpatched OpenSSL server to allocate 131 KB of memory. On glibc systems, that allocation isn't returned to the OS until the process restarts.

This isn't an immediate crash, but a slow-bleed DoS. If you haven't patched since June (when the fix shipped without an advisory), your memory footprint is likely growing.

Since we don't have a CVE to search for in our scanners, I whipped up a quick check to see if instances are vulnerable based on the fix timeline (rough check, assumes version 3.4.0+):

# Check OpenSSL version (Patch was released in June 2026 releases)
openssl version


And to detect potential active exploitation or scanning attempts on your edge, keep an eye on tiny TLS packets:

# Capture suspiciously small packets on port 443
tcpdump -i eth0 -n 'tcp port 443 and (tcp[tcpflags] & tcp-push != 0) and len < 20'

How is everyone handling silent patches like this in your patching cycles? Are you blindly auto-updating OpenSSL, or are you waiting for the CVE?