CVE-2025-66033 - CVE House
Back to Database
Status published Medium CVE-2025-66033

Improper Memory Cleanup in the Okta Java SDK

Vulnerability Description

Okta Java Management SDK facilitates interactions with the Okta management API. In versions 21.0.0 through 24.0.0, specific multithreaded implementations may encounter memory issues as threads are not properly cleaned up after requests are completed. Over time, this can degrade performance and availability in long-running applications and may result in a denial-of-service condition under sustained load. In addition to using the affected versions, users may be at risk if they are implementing a long-running application using the ApiClient in a multi-threaded manner. This issue is fixed in version 24.0.1.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-66033

Credits & Attribution

No credits recorded in the NVD database.

References

More from okta

View All →
CVE-2025-67505
Race condition in the Okta Java SDK
High 8.4
CVE-2021-45094
Imprivata Privileged Access Management (formally Xton Privileged Access Management) 2.3.202112051108...
Medium 5.4
CVE-2021-28113
A command injection vulnerability in the cookieDomain and relayDomain parameters...
Medium 6.7

Affected Vendor

Affected Software

okta-sdk-java
Vulnerable Versions:
>= 21.0.0, < 24.0.1

Timeline

Official Publish: December 10th, 2025
Last Modified: December 11th, 2025
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H

Weaknesses (CWE)

CWE-401

MITRE ATT&CK TTPs

T1499 Endpoint Denial of Service
Impact
T1190 Exploit Public-Facing Application
Initial Access
T1059 Command and Scripting Interpreter
Execution
T1486 Data Encrypted for Impact
Impact
T1562 Impair Defenses
Defense Evasion