FKIE_CVE-2025-66033

Vulnerability from fkie_nvd - Published: 2025-12-10 22:16 - Updated: 2026-09-25 23:10
Severity
5.3 (Medium) - CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
Summary
Okta Java Management SDK facilitates interactions with the Okta management API. In versions 21.0.0 through 24.0.0, specific multithreaded implementations may encounter memory issues as threads are not properly cleaned up after requests are completed. Over time, this can degrade performance and availability in long-running applications and may result in a denial-of-service condition under sustained load. In addition to using the affected versions, users may be at risk if they are implementing a long-running application using the ApiClient in a multi-threaded manner. This issue is fixed in version 24.0.1.
References
security-advisories@github.comhttps://github.com/okta/okta-sdk-java/commit/1daa9229a70fc38fb252aeaa637f82d0b0729b3fPatch
security-advisories@github.comhttps://github.com/okta/okta-sdk-java/security/advisories/GHSA-qhr6-6cgv-6638Vendor Advisory
Impacted products
Vendor Product Version
okta java_management_sdk *
To clipboard 

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "okta-sdk-java",
          "vendor": "okta",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 21.0.0, \u003c 24.0.1"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:okta:java_management_sdk:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "23BCEB28-B29D-4F50-9BC4-CB2B9A59FBCC",
              "versionEndExcluding": "24.0.1",
              "versionStartIncluding": "21.0.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Okta Java Management SDK facilitates interactions with the Okta management API. In versions 21.0.0 through 24.0.0, specific multithreaded implementations may encounter memory issues as threads are not properly cleaned up after requests are completed. Over time, this can degrade performance and availability in long-running applications and may result in a denial-of-service condition under sustained load. In addition to using the affected versions, users may be at risk if they are implementing a long-running application using the ApiClient in a multi-threaded manner. This issue is fixed in version 24.0.1."
    },
    {
      "lang": "es",
      "value": "El Okta Java Management SDK facilita las interacciones con la API de gesti\u00f3n de Okta. En las versiones 21.0.0 a la 24.0.0, implementaciones multihilo espec\u00edficas pueden encontrar problemas de memoria ya que los hilos no se limpian correctamente despu\u00e9s de que se completan las solicitudes. Con el tiempo, esto puede degradar el rendimiento y la disponibilidad en aplicaciones de larga ejecuci\u00f3n y puede resultar en una condici\u00f3n de denegaci\u00f3n de servicio bajo carga sostenida. Adem\u00e1s de usar las versiones afectadas, los usuarios pueden estar en riesgo si est\u00e1n implementando una aplicaci\u00f3n de larga ejecuci\u00f3n usando el ApiClient de manera multihilo. Este problema est\u00e1 solucionado en la versi\u00f3n 24.0.1."
    }
  ],
  "id": "CVE-2025-66033",
  "lastModified": "2026-09-25T23:10:00.463",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "HIGH",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 5.3,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 1.6,
        "impactScore": 3.6,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-66033",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2025-12-11T15:40:05.587445Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2025-12-10T22:16:27.520",
  "references": [
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Patch"
      ],
      "url": "https://github.com/okta/okta-sdk-java/commit/1daa9229a70fc38fb252aeaa637f82d0b0729b3f"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://github.com/okta/okta-sdk-java/security/advisories/GHSA-qhr6-6cgv-6638"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-401"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.