OpenSSL “HollowByte” Flaw Enables 131 KB Memory Exhaustion with 11‑Byte TLS Requests
What Happened — Researchers at Okta discovered a denial‑of‑service vulnerability in OpenSSL that allocates up to 131 KB of memory for a single 11‑byte TLS request that never completes. The allocation persists until the affected process is restarted, effectively freezing the server. The fix was shipped in June without a CVE, advisory, or changelog entry.
Why It Matters for Compliance & Audit Readiness
- The flaw illustrates why continuous control mapping of third‑party libraries and patch status is essential for SOC 2 evidence of “System Operations” and “Change Management.”
- Without documented, automated evidence that critical cryptographic components are up‑to‑date, auditors may flag gaps in the “Vulnerability Management” control (CC6.1).
- A formal, continuously‑collected audit trail of library versions and remediation actions helps demonstrate due diligence during a SOC 2 audit.
Who Is Affected — Cloud‑infrastructure providers, SaaS platforms, fintech, health‑tech, and any organization that runs OpenSSL‑enabled services.
Recommended Actions
- Inventory all production assets that embed OpenSSL and verify they run the June 2026 “HollowByte” patch.
- Map the OpenSSL version to your SOC 2 “Vulnerability Management” control and capture the verification as immutable evidence.
- Integrate automated version‑checking tools into your continuous compliance pipeline to generate audit‑ready logs.
Source: The Hacker News
Technical Notes
- Attack vector: crafted TLS handshake that triggers a memory allocation bug (no CVE assigned).
- Impact: denial‑of‑service (memory exhaustion) on glibc‑based systems; no data exfiltration reported.
- Mitigation: upgrade to OpenSSL 3.2.1‑h (June 2026) or later; restart affected services after patching.