5.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-66033

CVE-2025-66033: Improper Memory Cleanup in the Okta Java SDK

Okta Java Management SDK facilitates interactions with the Okta management API. In versions 21.0.0 through 24.0.0, specific multithreaded implementations may encounter memory issues as threads are not properly cleaned up after requests are completed. Over time, this can degrade performance and availability in long-running applications and may result in a denial-of-service condition under sustained load. In addition to using the affected versions, users may be at risk if they are implementing a long-running application using the ApiClient in a multi-threaded manner. This issue is fixed in version 24.0.1.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-66033

CVE-2025-66033:

5.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
com.okta.sdk:okta-sdk-root	maven	>= 21.0.0, <= 24.0.0	24.0.1

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a memory leak in the Okta Java SDK caused by improper state management in the ApiClient class. The root cause was the use of ConcurrentHashMap instances (lastStatusCodeByThread and lastResponseHeadersByThread) to store response data, using the thread ID as the key.

In long-running, multi-threaded applications (e.g., using thread pools), threads are created and destroyed, but the entries in these maps were never removed. This resulted in an unbounded growth of the maps, consuming memory and eventually leading to a denial-of-service.

The core vulnerable function is com.okta.sdk.resource.client.ApiClient.processResponse, which populated these maps on every API call. The methods getStatusCode and getResponseHeaders read from these maps. The legacy pagination helper, com.okta.sdk.helper.PaginationUtil, used apiClient.getResponseHeaders() to manage pagination, making it a primary trigger for the vulnerable logic.

The patch resolves this by replacing the ConcurrentHashMaps with ThreadLocal variables. ThreadLocal ensures that the stored data is scoped to the lifecycle of the thread and is automatically garbage-collected when the thread terminates, thus fixing the leak. The patch also introduces a new thread-safe, stateless pagination mechanism (PagedIterable) and deprecates the old, vulnerable methods.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.