HollowByte is a denial-of-service vulnerability affecting OpenSSL servers, where an attacker sends a minimal 11-byte TLS handshake message with a header claiming a much larger payload size. Vulnerable OpenSSL versions allocate memory according to the claimed size before receiving the actual data, causing the server to block waiting for data that never arrives and to allocate excessive memory. The GNU C Library's memory allocator behavior exacerbates the issue by retaining freed memory chunks, leading to heap fragmentation and persistent memory bloat. The vulnerability was silently fixed by the OpenSSL team in version 4.0.1 and backported to versions 3.6.3, 3.5.7, 3.4.6, and 3.0.21, where the buffer is only grown upon actual data arrival, ignoring the header's claimed size.

This vulnerability enables unauthenticated attackers to cause a denial-of-service condition by exhausting server memory resources through repeated connections with small malicious payloads. It can degrade server performance and availability, especially in low-capacity environments, and cause up to 25% memory loss on higher-spec servers without triggering bandwidth-based alerts. The memory bloat persists even after attackers disconnect, requiring a server process restart to fully reclaim memory. While it does not allow data theft or code execution, it can disrupt operations and damage reputation.

A fix is available. The OpenSSL team has released version 4.0.1 containing a fix for this issue and backported the patch to versions 3.6.3, 3.5.7, 3.4.6, and 3.0.21. Organizations should prioritize upgrading to these fixed versions immediately to mitigate the risk. No other mitigation is indicated by the vendor advisory.