OpenSSL Silently Fixes ‘HollowByte’ DoS Vulnerability

Attackers could send waves of malicious payloads to trigger buffer pre-allocations that are not freed, exhausting server memory. The post OpenSSL Silently Fixes ‘HollowByte’ DoS Vulnerability appeared first on SecurityWeek .

The article reports on HollowByte, a denial-of-service vulnerability in OpenSSL where an unauthenticated attacker can send an 11-byte malicious TLS payload that causes disproportionate buffer pre-allocation (up to ~131 KB per connection), leading to memory exhaustion and possible out-of-memory conditions on affected servers.[1][2][3][5][6][7] OpenSSL fixed the issue by switching to incremental buffer growth and silently shipped patches in versions 4.0.1, 3.6.3, 3.5.7, 3.4.6, and 3.0.21, without a CVE or prominent advisory.[1][3][4][6] From a RealGround perspective, this highlights an AI supply chain risk: organizations relying on OpenSSL in AI infrastructure and model-serving stacks may be unknowingly exposed if they depend on changelog/CVE-based scanners and do not have robust SBOM-driven dependency monitoring. Practically, teams should inventory OpenSSL usage across AI services, enforce timely patching, and integrate silent or "bug-only" security fixes into their AI Security Readiness processes to prevent memory-exhaustion outages of AI agents and APIs that depend on TLS termination.