HollowByte: OpenSSL Pre-Authentication TLS DoS Flaw Bloats Server Memory With 11-Byte Payload

HollowByte: OpenSSL Pre-Authentication TLS DoS Flaw Bloats (TL-2026-1457), also tracked as HollowByte, is a medium-severity software vulnerability, first published 2026-07-17. It has no confirmed attribution, affects OpenSSL OpenSSL, references 6 CVEs (CVE-2026-45447, CVE-2026-34183, CVE-2026-34182), maps to 14 MITRE ATT&CK techniques (T1046, T1070, T1190), and is covered by 9 detection rules and 21 indicators of compromise.

Key facts for TL-2026-1457

Threat ID
TL-2026-1457
Also known as
HollowByte
Severity
MEDIUM
Status
ACTIVE
Category
VULNERABILITY
First published
2026-07-17
Last reviewed
2026-07-17
Attribution confidence
LOW
Motivation
UNKNOWN
Target sectors
technology, cloud-hosting, finance, government administration, health, ecommerce, telecoms, education
Target regions
Global
Detection rules
9
Indicators of compromise
21

Malware and tooling in HollowByte: OpenSSL Pre-Authentication TLS DoS Flaw Bloats

Malware and tooling: openssl-1.0.2zq, openssl-1.1.1zh, openssl-3.0.21, openssl-3.4.6, openssl-3.5.7, openssl-3.6.3, openssl-4.0.1

Okta's Red Team disclosed HollowByte, a pre-authentication denial-of-service weakness in OpenSSL where an unauthenticated attacker sends a malicious 11-byte TLS handshake header declaring a much larger message body, causing OpenSSL to pre-allocate up to 131KB of memory before any payload data arrives or is validated. OpenSSL treated the issue as a silent hardening fix rather than a CVE-tracked vulnerability, patching it in the same June 9, 2026 release train (4.0.1, 3.6.3, 3.5.7, 3.4.6, 3.0.21) that also fixed 17 formally-tracked CVEs, including the critical PKCS7_verify() heap use-after-free (CVE-2026-45447) and the QUIC PATH_CHALLENGE unbounded memory growth flaw (CVE-2026-34183).

How HollowByte: OpenSSL Pre-Authentication TLS DoS Flaw Bloats works

HollowByte is a memory-exhaustion denial-of-service weakness in OpenSSL's TLS handshake-message parsing, publicly detailed by Okta's Red Team on July 16, 2026 (published via BleepingComputer July 17, 2026) and independently by Okta's own security advisory (sec.okta.com). The root cause is a classic allocate-before-validate pattern: during the ClientHello / handshake message phase, OpenSSL reads a 4-byte handshake message header containing a 3-byte length field that declares how much payload data will follow. Vulnerable versions call grow_init_buf(), which in turn calls OPENSSL_clear_realloc() -> malloc(), to pre-allocate a receive buffer sized to the attacker-declared length BEFORE any of the actual payload bytes have arrived on the wire or been validated. An attacker who sends just 11 bytes total -- a TCP/TLS connection open plus a malformed 4-byte header claiming an oversized body -- can force the server to allocate up to 131KB per connection while the worker thread blocks indefinitely waiting for payload data that never arrives, an amplification ratio of roughly 11,900:1.

Because each individual allocation (131KB) and each individual connection may fall under naive connection-count or per-request size limits, standard rate-limiting and connection-ceiling defenses are insufficient to stop the attack -- an attacker opens many low-and-slow connections, each looking unremarkable in isolation. Okta's testing showed the effect compounds via glibc's memory allocator behavior: glibc does not immediately return small-to-medium freed allocations to the OS, retaining them for reuse. Waves of connections using randomized claimed sizes prevent heap consolidation and fragment the process heap, so memory remains bloated even after the offending connections are torn down. Okta tested unpatched and patched OpenSSL instances running NGINX under load; in a 1GB-constrained test environment, unpatched OpenSSL servers were driven to an OOM-kill after allocating roughly 547MB; in a higher-spec 16GB environment, the technique consumed approximately 25% of total system memory.

OpenSSL's maintainers characterized the fix as a hardening improvement rather than a security vulnerability warranting a CVE, and it shipped silently as three merged pull requests (#30792, #30793, #30794) bundled into the same June 9, 2026 release train that formally patched 17 numbered CVEs across the actively-maintained branches (4.0.1, 3.6.3, 3.5.7, 3.4.6, 3.0.21). The release train's headline issue was CVE-2026-45447 (CVSS 9.8 Critical), a heap use-after-free in PKCS7_verify(): when a PKCS#7 or S/MIME SignedData structure's digestAlgorithms field is present as an empty ASN.1 SET, OpenSSL may incorrectly free a caller-owned BIO during verification, so a subsequent BIO_free() by the calling application triggers a use-after-free that can crash the process, corrupt the heap, or potentially enable remote code execution; it affects OpenSSL from the 1.0.2/1.1.1 branches through 4.0, with fixes also back-ported to premium-support branches 1.1.1zh and 1.0.2zq. The same release also fixed CVE-2026-34183 (Moderate), unbounded memory growth in the QUIC PATH_CHALLENGE handler -- a remote peer can flood a QUIC client or server with PATH_CHALLENGE frames, forcing allocation of a PATH_RESPONSE frame per challenge that is only freed once the (malicious, non-cooperating) peer acknowledges it, exhausting heap memory and causing abnormal termination -- a resource-exhaustion bug in the same allocate-on-untrusted-input family as HollowByte itself, affecting OpenSSL 4.0, 3.6, 3.5, 3.4, and 3.0 (not 1.1.1/1.0.2). Other issues in the same train included CVE-2026-34182 (CMS AuthEnvelopedData forgery), CVE-2026-35188 (double-free in OCSP staple verification, 4.0.1/3.6.3), CVE-2026-42764 (NULL pointer dereference in QUIC server packet handling, 4.0.1/3.6.3/3.5.7), CVE-2026-45445 (AES-OCB IV bypass enabling universal forgery, all versions), plus roughly ten Low-severity issues spanning ASN.1 parsing buffer over-reads, PKCS#12 validation weaknesses, CMS decryption NULL dereferences, certificate-verification crashes, and email-address validation errors. FIPS-validated modules were unaffected by most of the release's issues since the vulnerable code paths sit outside the FIPS module boundary.

The fix for HollowByte itself replaces pre-allocation-from-declared-length with incremental/deferred buffer growth: OpenSSL now grows the receive buffer only as data actually arrives on the socket, ignoring the attacker's claimed length until it is backed by real bytes.

Because OpenSSL underlies the TLS stack of an enormous swath of internet-facing infrastructure -- either linked directly or bundled -- the blast radius extends far beyond OpenSSL itself to downstream software including NGINX, Apache HTTP Server, Node.js, Python (via the ssl module), Ruby, PHP, MySQL, PostgreSQL, and most mainstream Linux distributions that ship OpenSSL as the default TLS provider. No CVE has been assigned to HollowByte as of publication, it is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, there is no confirmed in-the-wild exploitation, and no independent CVSS score has been published for HollowByte itself (unlike its release-train companion CVE-2026-45447, rated 9.8 Critical); the hunt/tracking rationale for this threat record is the pre-authentication, minimal-payload nature of the DoS combined with the breadth of downstream affected software and the fact that vendor patches already exist across five concurrently-supported release branches. Administrators are advised to upgrade their distribution's OpenSSL packages (or statically-linked application bundles) immediately, since standard connection-limiting defenses do not stop the attack, and to prioritize the same release train's CVE-2026-45447 (RCE-capable UAF) given its far higher severity.

MITRE ATT&CK techniques used in TL-2026-1457

Discovery

T1046 Network Service Discovery; T1518 Software Discovery

Defense Evasion

T1070 Indicator Removal

Initial Access

T1190 Exploit Public-Facing Application

Execution

T1203 Exploitation for Client Execution

Impact

T1489 Service Stop; T1498 Network Denial of Service; T1499 Endpoint Denial of Service; T1529 System Shutdown/Reboot

Resource Development

T1583 Acquire Infrastructure; T1587 Develop Capabilities

Reconnaissance

T1590 Gather Victim Network Information; T1592 Gather Victim Host Information; T1595 Active Scanning

Affected products and versions in HollowByte: OpenSSL Pre-Authentication TLS DoS Flaw Bloats

  • OpenSSL — OpenSSL
    Vulnerable versions: < 4.0.1; 3.6.x < 3.6.3; 3.5.x < 3.5.7; 3.4.x < 3.4.6; 3.0.x < 3.0.21
    Fixed in: 4.0.1; 3.6.3; 3.5.7; 3.4.6; 3.0.21
  • OpenSSL — OpenSSL (CVE-2026-45447 PKCS7_verify UAF)
    Vulnerable versions: 1.0.2; 1.1.1; 3.0; 3.4; 3.5; 3.6; 4.0
    Fixed in: 4.0.1; 3.6.3; 3.5.7; 3.4.6; 3.0.21; 1.1.1zh; 1.0.2zq
  • OpenSSL — OpenSSL (CVE-2026-34183 QUIC PATH_CHALLENGE)
    Vulnerable versions: 3.0; 3.4; 3.5; 3.6; 4.0
    Fixed in: 4.0.1; 3.6.3; 3.5.7; 3.4.6; 3.0.21
  • F5 / NGINX — NGINX
    Vulnerable versions: any build linked against a vulnerable OpenSSL version
    Fixed in: rebuild against patched OpenSSL 4.0.1/3.6.3/3.5.7/3.4.6/3.0.21
  • Apache Software Foundation — Apache HTTP Server
    Vulnerable versions: any build linked against a vulnerable OpenSSL version
    Fixed in: rebuild against patched OpenSSL 4.0.1/3.6.3/3.5.7/3.4.6/3.0.21
  • OpenJS Foundation — Node.js
    Vulnerable versions: any release bundling a vulnerable OpenSSL version
    Fixed in: release with bundled OpenSSL upgraded to a patched version
  • Python Software Foundation — Python (ssl module)
    Vulnerable versions: any build linked against a vulnerable OpenSSL version
    Fixed in: rebuild against patched OpenSSL 4.0.1/3.6.3/3.5.7/3.4.6/3.0.21
  • Ruby — Ruby (OpenSSL gem/binding)
    Vulnerable versions: any build linked against a vulnerable OpenSSL version
    Fixed in: rebuild against patched OpenSSL 4.0.1/3.6.3/3.5.7/3.4.6/3.0.21
  • PHP Group — PHP (OpenSSL extension)
    Vulnerable versions: any build linked against a vulnerable OpenSSL version
    Fixed in: rebuild against patched OpenSSL 4.0.1/3.6.3/3.5.7/3.4.6/3.0.21
  • Oracle / MySQL — MySQL
    Vulnerable versions: any build linked against a vulnerable OpenSSL version
    Fixed in: rebuild against patched OpenSSL 4.0.1/3.6.3/3.5.7/3.4.6/3.0.21

Remediation for HollowByte: OpenSSL Pre-Authentication TLS DoS Flaw Bloats

Patches

  • OpenSSL 4.0.1 (fixes HollowByte plus CVE-2026-45447, CVE-2026-34183, CVE-2026-34182, CVE-2026-35188, CVE-2026-42764, CVE-2026-45445, and ~10 Low-severity CVEs)
  • OpenSSL 3.6.3
  • OpenSSL 3.5.7
  • OpenSSL 3.4.6
  • OpenSSL 3.0.21
  • OpenSSL 1.1.1zh (premium support, CVE-2026-45447 only)
  • OpenSSL 1.0.2zq (premium support, CVE-2026-45447 only)

Immediate actions

  • Upgrade OpenSSL to 4.0.1, 3.6.3, 3.5.7, 3.4.6, or 3.0.21 (or later) on the appropriate release branch
  • Rebuild and redeploy any application that statically links OpenSSL (rather than relying on the system shared library) against a patched version
  • Patch or upgrade downstream software bundling/linking OpenSSL: NGINX, Apache HTTP Server, Node.js, Python, Ruby, PHP, MySQL, PostgreSQL
  • Monitor for anomalous TLS worker-thread memory growth and stalled/blocked handshake connections that never complete, since standard connection-count rate limiting does not detect or prevent this attack
  • Prioritize patching CVE-2026-45447 (PKCS7_verify heap use-after-free, CVSS 9.8) in the same release train, since it is RCE-capable and far higher severity than HollowByte itself
  • Audit QUIC-terminating services for CVE-2026-34183 exposure (PATH_CHALLENGE flood) if QUIC is in use

Workarounds

  • Terminate TLS at a hardened reverse proxy with aggressive incomplete-handshake and slow-client timeouts as an interim compensating control
  • Impose strict per-connection memory ceilings / cgroup limits on TLS-terminating worker processes to bound worst-case impact pending patching

Longer-term hardening

  • Deploy TLS-terminating reverse proxies or load balancers with strict per-connection handshake timeouts and incomplete-handshake reaping
  • Implement memory-usage-based autoscaling / circuit breakers on TLS-terminating services so gradual heap bloat triggers alerting before OOM
  • Track vendor OpenSSL advisories and 'hardening fix' changelog entries proactively, since not every memory-safety fix receives a CVE
  • Include OpenSSL and its statically-linked consumers in regular dependency/SBOM audits to catch bundled-but-unpatched copies
  • Establish periodic review of OpenSSL GitHub merged pull requests for silent security-relevant hardening fixes that bypass the CVE process

CVEs associated with HollowByte: OpenSSL Pre-Authentication TLS DoS Flaw Bloats

CVE-2026-45447, CVE-2026-34183, CVE-2026-34182, CVE-2026-35188, CVE-2026-42764, CVE-2026-45445

Weaknesses (CWE) in HollowByte: OpenSSL Pre-Authentication TLS DoS Flaw Bloats

CWE-789, CWE-400, CWE-770, CWE-416

Timeline of HollowByte: OpenSSL Pre-Authentication TLS DoS Flaw Bloats

  • Node.js publishes its January 2026 OpenSSL security-fix assessment blog post, part of the ongoing pattern of downstream runtimes tracking and re-bundling OpenSSL security releases that later becomes relevant to the June 2026 HollowByte-bearing release train.
  • Okta's Red Team publishes 'OpenSSL HollowByte: A DoS Hiding in 11 Bytes' on sec.okta.com, detailing the discovery, root-cause analysis (grow_init_buf -> OPENSSL_clear_realloc -> malloc pre-allocation), and testing results showing OOM-kill after ~547MB in a 1GB test environment and ~25% memory consumption in a 16GB environment, using unpatched/patched OpenSSL instances running NGINX.
  • CVE-2026-34183 (Unbounded Memory Growth in the QUIC PATH_CHALLENGE Handler) is disclosed in the same release train, tracked publicly via Red Hat Bugzilla #2481885 and NVD; a remote peer floods a QUIC endpoint with PATH_CHALLENGE frames, forcing per-frame PATH_RESPONSE allocations that are only freed on acknowledgment from the (malicious) peer -- a resource-exhaustion bug in the same family as HollowByte.
  • OpenSSL Library publishes its release/advisory timeline entry and oss-security mailing list advisory documenting the 4.0.1, 3.6.3, 3.5.7, 3.4.6, and 3.0.21 releases and the accompanying CVE list (CVE-2026-45447, CVE-2026-34183, CVE-2026-34182, CVE-2026-35188, CVE-2026-42764, CVE-2026-45445, plus ~10 Low-severity issues).
  • OpenSSL silently ships the HollowByte hardening fix (merged as GitHub PRs #30792, #30793, #30794) bundled into the coordinated 4.0.1/3.6.3/3.5.7/3.4.6/3.0.21 security release train, which formally fixes 17 numbered CVEs including CVE-2026-45447 (PKCS7_verify heap use-after-free, CVSS 9.8) and CVE-2026-34183 (QUIC PATH_CHALLENGE unbounded memory growth).
  • Security press (cybersecuritymarket.com, vpncentral.com, dailysecurityreview.com) covers the June 9 OpenSSL release, focusing on the higher-severity CVE-2026-45447 PKCS7_verify() heap use-after-free RCE issue in the same release train.
  • Broader public disclosure/amplification of the HollowByte research date referenced in follow-on press coverage, roughly six weeks after the underlying OpenSSL patch shipped.
  • TL-Intel Harness opens threat record TL-2026-1457 to track HollowByte as a broad-impact, pre-authentication DoS advisory pending any future CVE assignment.
  • BleepingComputer publishes 'HollowByte DDoS flaw bloats OpenSSL server memory with 11-byte payload,' bringing the issue to mainstream security-news attention and triggering TL-Intel hunt ingestion via the BleepingComputer RSS feed.

Sources cited for HollowByte: OpenSSL Pre-Authentication TLS DoS Flaw Bloats

Threats related to HollowByte: OpenSSL Pre-Authentication TLS DoS Flaw Bloats

Detection coverage for TL-2026-1457

As of 2026-07-17, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1457 across Splunk SPL, Microsoft KQL and Sigma, covering 21 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats