OpenSSL HollowByte Flaw Could Freeze Server Memory with 11-Byte TLS Requests

A vulnerability in OpenSSL, known as HollowByte, can cause an unpatched server to allocate a significant amount of memory in response to a short TLS request. Specifically, an 11-byte request can lead to the server setting aside up to 131 KB of memory for a message that never arrives. On systems using glibc, this memory allocation is permanent until the process is restarted. The HollowByte flaw was fixed by OpenSSL in June, but the update was not accompanied by a CVE, advisory, or changelog entry. The issue was discovered and reported by Okta's Red Team, which also named the vulnerability.