OpenSSL “HollowByte” Memory‑Exhaustion Vulnerability Allows Remote DoS with an 11‑Byte Payload
What Happened – Okta’s red‑team disclosed “HollowByte,” an 11‑byte OpenSSL flaw that lets an unauthenticated remote attacker trigger a pre‑allocation of up to 131 KB before any TLS data arrives. The allocation is never reclaimed, causing heap fragmentation and eventual out‑of‑memory (OOM) termination of the process. The issue exists in older OpenSSL releases and was patched by the OpenSSL project.
Why It Matters for Compliance & Audit Readiness
- SOC 2 CC6.1 (System Operations) requires documented, repeatable processes for patch management; an unpatched library creates a control gap that can be flagged in an audit.
- Continuous‑compliance programs must capture evidence that third‑party components are up‑to‑date; the HollowByte fix is a concrete example of why that evidence is essential.
- The vulnerability demonstrates how a single unchecked allocation can bypass typical connection‑rate limits, underscoring the need for runtime monitoring controls (CC7.1 Change Management) and defensible logs.
Who Is Affected – Any organization that embeds OpenSSL in its stack – cloud‑hosting platforms, SaaS applications, fintech services, telecom back‑ends, and on‑premise appliances.
Recommended Actions
- Inventory all systems running OpenSSL and verify the version against the released patch.
- Apply the OpenSSL update immediately; for legacy systems, implement temporary mitigations such as strict connection‑rate limiting and memory‑usage alerts.
- Update your change‑management and patch‑management policies to require documented evidence of library version compliance (e.g., signed build artefacts).
- Integrate runtime memory‑usage monitoring into your SOC 2 evidence collection pipeline.
Source: SecurityAffairs – OpenSSL Fixes HollowByte Memory Exhaustion Bug
Technical Notes – Attack vector: remote unauthenticated payload; exploitation occurs during the TLS handshake before any authentication. No CVE identifier was assigned at time of reporting. The flaw leads to denial‑of‑service (memory exhaustion) without data exfiltration.