CVE-2025-66033

Okta Java Management SDK facilitates interactions with the Okta management API. In versions 21.0.0 through 24.0.0, specific multithreaded implementations may encounter memory issues as threads are not properly cleaned up after requests are completed. Over time, this can degrade performance and availability in long-running applications and may result in a denial-of-service condition under sustained load. In addition to using the affected versions, users may be at risk if they are implementing a long-running application using the ApiClient in a multi-threaded manner. This issue is fixed in version 24.0.1.

CVSS v3 5.3 MEDIUM

5.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.6 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/okta/okta-sdk-java/commit/1daa9229a70fc38fb252aeaa637f82d0b0729b3f	Patch
https://github.com/okta/okta-sdk-java/security/advisories/GHSA-qhr6-6cgv-6638	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:okta:java_management_sdk:*:*:*:*:*:*:*:*

History

25 Sep 2026, 23:10

Type	Values Removed	Values Added
Summary		(es) El Okta Java Management SDK facilita las interacciones con la API de gestión de Okta. En las versiones 21.0.0 a la 24.0.0, implementaciones multihilo específicas pueden encontrar problemas de memoria ya que los hilos no se limpian correctamente después de que se completan las solicitudes. Con el tiempo, esto puede degradar el rendimiento y la disponibilidad en aplicaciones de larga ejecución y puede resultar en una condición de denegación de servicio bajo carga sostenida. Además de usar las versiones afectadas, los usuarios pueden estar en riesgo si están implementando una aplicación de larga ejecución usando el ApiClient de manera multihilo. Este problema está solucionado en la versión 24.0.1.

Information

Published : 2025-12-10 22:16

Updated : 2026-09-25 23:10

NVD link : CVE-2025-66033

Mitre link : CVE-2025-66033

CVE.ORG link : CVE-2025-66033

JSON object : View

Products Affected

okta

java_management_sdk

CWE

CWE-401

Missing Release of Memory after Effective Lifetime

{"id": "CVE-2025-66033", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-66033", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-12-11T15:40:05.587445Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 1.6}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "okta", "product": "okta-sdk-java", "versions": [{"status": "affected", "version": ">= 21.0.0, < 24.0.1"}]}]}], "published": "2025-12-10T22:16:27.520", "references": [{"url": "https://github.com/okta/okta-sdk-java/commit/1daa9229a70fc38fb252aeaa637f82d0b0729b3f", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/okta/okta-sdk-java/security/advisories/GHSA-qhr6-6cgv-6638", "tags": ["Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-401"}]}], "descriptions": [{"lang": "en", "value": "Okta Java Management SDK facilitates interactions with the Okta management API. In versions 21.0.0 through 24.0.0, specific multithreaded implementations may encounter memory issues as threads are not properly cleaned up after requests are completed. Over time, this can degrade performance and availability in long-running applications and may result in a denial-of-service condition under sustained load. In addition to using the affected versions, users may be at risk if they are implementing a long-running application using the ApiClient in a multi-threaded manner. This issue is fixed in version 24.0.1."}, {"lang": "es", "value": "El Okta Java Management SDK facilita las interacciones con la API de gesti\u00f3n de Okta. En las versiones 21.0.0 a la 24.0.0, implementaciones multihilo espec\u00edficas pueden encontrar problemas de memoria ya que los hilos no se limpian correctamente despu\u00e9s de que se completan las solicitudes. Con el tiempo, esto puede degradar el rendimiento y la disponibilidad en aplicaciones de larga ejecuci\u00f3n y puede resultar en una condici\u00f3n de denegaci\u00f3n de servicio bajo carga sostenida. Adem\u00e1s de usar las versiones afectadas, los usuarios pueden estar en riesgo si est\u00e1n implementando una aplicaci\u00f3n de larga ejecuci\u00f3n usando el ApiClient de manera multihilo. Este problema est\u00e1 solucionado en la versi\u00f3n 24.0.1."}], "lastModified": "2026-09-25T23:10:00.463", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:okta:java_management_sdk:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "23BCEB28-B29D-4F50-9BC4-CB2B9A59FBCC", "versionEndExcluding": "24.0.1", "versionStartIncluding": "21.0.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}