HollowByte is a denial-of-service vulnerability in OpenSSL where an attacker sends a small malicious payload (11 bytes) that declares a large incoming message size, causing OpenSSL to pre-allocate a buffer that is not immediately freed. The worker thread then blocks indefinitely waiting for data that never arrives. Although OpenSSL frees the buffer when the connection drops, the GNU C Library (glibc) retains these allocations for reuse, preventing memory from being returned to the OS. Repeated exploitation leads to memory fragmentation and exhaustion, causing server unresponsiveness. This vulnerability affects older OpenSSL versions that pre-allocate buffers based on handshake message headers. The issue was silently fixed in OpenSSL 4.0.1 and backported to versions 3.6.3, 3.5.7, 3.4.6, and 3.0.21 by changing buffer allocation to depend on actual incoming bytes rather than declared sizes.

Successful exploitation results in denial-of-service by exhausting server memory, causing the server process to become unresponsive and requiring a restart to reclaim memory. The attack can consume significant memory (e.g., 25% of total system memory on a 16 GB system) while staying below connection limits, bypassing standard connection-limiting defenses. This affects any application, server, runtime, or database using vulnerable OpenSSL versions, including Apache, NGINX, Node.js, Python, Ruby, PHP, MySQL, and PostgreSQL.

Patches addressing the HollowByte vulnerability have been silently included in OpenSSL version 4.0.1 and backported to versions 3.6.3, 3.5.7, 3.4.6, and 3.0.21. Users should upgrade to one of these patched versions to mitigate the vulnerability. No additional mitigations are indicated by the vendor advisory. If upgrading is not immediately possible, terminating the affected process can reclaim memory, but this is a temporary measure.