TI-2025-40559 Aliases CVE-2025-66033 GHSA-qhr6-6cgv-6638

Improper Memory Cleanup in the Okta Java SDK

LOW 24CWE-401Published 2025-12-10 · Updated 2025-12-11

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: High
Impact type: Denial of service
Confidentiality · integrity · availability: None · None · High
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-401.

Summary

Okta Java Management SDK facilitates interactions with the Okta management API. In versions 21.0.0 through 24.0.0, specific multithreaded implementations may encounter memory issues as threads are not properly cleaned up after requests are completed. Over time, this can degrade performance and availability in long-running applications and may result in a denial-of-service condition under sustained load. In addition to using the affected versions, users may be at risk if they are implementing a long-running application using the ApiClient in a multi-threaded manner. This issue is fixed in version 24.0.1.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00271 19th percentileScored 2026-11-07

Fix Fixed okta-sdk-java (okta): 24.0.1com.okta.sdk:okta-sdk-root (Maven): 24.0.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Okta	okta-sdk-java	21.0.0 to before 24.0.1	24.0.1	Patch available	CNA
—	com.okta.sdk:okta-sdk-root (Maven)	21.0.0 to before 24.0.1	24.0.1	Patch available	GHSA-qhr6-6cgv-6638

okta-sdk-java VendorOkta Affected 21.0.0 to before 24.0.1 Fixed in 24.0.1 Patch available CNA
com.okta.sdk:okta-sdk-root (Maven) Vendor— Affected 21.0.0 to before 24.0.1 Fixed in 24.0.1 Patch available GHSA-qhr6-6cgv-6638

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:okta:java_management_sdk::::::::	21.0.0 to before 24.0.1	Vulnerable	Okta

cpe:2.3:a:okta:java_management_sdk:*:*:*:*:*:*:*:* Versions 21.0.0 to before 24.0.1 Vulnerable ·Okta

Remediation

Fix · CNA okta-sdk-java (okta) Fixed in 24.0.1
Fix · GHSA-qhr6-6cgv-6638 com.okta.sdk:okta-sdk-root (Maven) Fixed in 24.0.1 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2025-66033
2026-10-03 Alias added: GHSA-qhr6-6cgv-6638

References

Patch 1

https://github.com/okta/okta-sdk-java/commit/1daa9229a70fc38fb252aeaa637f82d0b0729b3f

Advisory 2

Other 1

https://github.com/okta/okta-sdk-java

TI-2025-41261 Race condition in the Okta Java SDK CVSS 3.1HIGH 8.4

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences