On the "HollowByte" denial-of-service report

{
  "id": "766374bced02fbb9770b501fc60dd3faa6890f7f2dbf0739307538d4a9fc3632",
  "url": "https://openssl-library.org/post/2026-07-21-hollowbyte/",
  "method": "llm",
  "payload": {
    "kind": "patch",
    "title": "On the \"HollowByte\" denial-of-service report",
    "summary": "OpenSSL changed TLS handshake buffer allocation to grow incrementally as data arrives, reducing memory tied up by stalled handshakes. The announcement classifies this as a hardening fix, not a vulnerability, and recommends connection timeouts and limits to address slow-connection attacks.",
    "evidence": "OpenSSL now grows the handshake buffer incrementally as data actually arrives, in chunks of at most one TLS record (16 KB), rather than trusting the declared length up front.",
    "products": [
      {
        "name": {
          "value": "OpenSSL",
          "evidence": "This change is present in OpenSSL 4.0.1, 3.6.3, 3.5.7, 3.4.6 and 3.0.21."
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "4.0.1",
            "evidence": "This change is present in OpenSSL 4.0.1, 3.6.3, 3.5.7, 3.4.6 and 3.0.21."
          },
          {
            "value": "3.6.3",
            "evidence": "This change is present in OpenSSL 4.0.1, 3.6.3, 3.5.7, 3.4.6 and 3.0.21."
          },
          {
            "value": "3.5.7",
            "evidence": "This change is present in OpenSSL 4.0.1, 3.6.3, 3.5.7, 3.4.6 and 3.0.21."
          },
          {
            "value": "3.4.6",
            "evidence": "This change is present in OpenSSL 4.0.1, 3.6.3, 3.5.7, 3.4.6 and 3.0.21."
          },
          {
            "value": "3.0.21",
            "evidence": "This change is present in OpenSSL 4.0.1, 3.6.3, 3.5.7, 3.4.6 and 3.0.21."
          }
        ],
        "affected_versions": []
      }
    ],
    "severity": "unknown",
    "fixed_cves": [],
    "related_cves": [
      {
        "value": "CVE-2026-34183",
        "evidence": "in the same set of releases we assigned CVE-2026-34183 (Moderate) to a QUIC PATH_CHALLENGE flooding issue"
      }
    ],
    "security_relevant": true,
    "severity_evidence": null
  },
  "source_id": "official-openssl-news",
  "document_id": 24077,
  "published_at": "2026-07-21T00:00:00+00:00"
}