-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIA Semantic Attack on Google Gemini - Read the Latest Research
A Semantic Attack on Google Gemini - Read the Latest Research
Miggo AI
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| com.okta.sdk:okta-sdk-root | maven | >= 21.0.0, <= 24.0.0 | 24.0.1 |
Miggo AIRoot Cause AnalysisThe vulnerability is a memory leak in the Okta Java SDK caused by improper state management in the ApiClient class. The root cause was the use of ConcurrentHashMap instances (lastStatusCodeByThread and lastResponseHeadersByThread) to store response data, using the thread ID as the key.
In long-running, multi-threaded applications (e.g., using thread pools), threads are created and destroyed, but the entries in these maps were never removed. This resulted in an unbounded growth of the maps, consuming memory and eventually leading to a denial-of-service.
The core vulnerable function is com.okta.sdk.resource.client.ApiClient.processResponse, which populated these maps on every API call. The methods getStatusCode and getResponseHeaders read from these maps. The legacy pagination helper, com.okta.sdk.helper.PaginationUtil, used apiClient.getResponseHeaders() to manage pagination, making it a primary trigger for the vulnerable logic.
The patch resolves this by replacing the ConcurrentHashMaps with ThreadLocal variables. ThreadLocal ensures that the stored data is scoped to the lifecycle of the thread and is automatically garbage-collected when the thread terminates, thus fixing the leak. The patch also introduces a new thread-safe, stateless pagination mechanism (PagedIterable) and deprecates the old, vulnerable methods.
com.okta.sdk.resource.client.ApiClient.processResponseapi/src/main/resources/custom_templates/ApiClient.mustache
com.okta.sdk.resource.client.ApiClient.getResponseHeadersapi/src/main/resources/custom_templates/ApiClient.mustache
com.okta.sdk.resource.client.ApiClient.getStatusCodeapi/src/main/resources/custom_templates/ApiClient.mustache
com.okta.sdk.helper.PaginationUtil.getAfterapi/src/main/java/com/okta/sdk/helper/PaginationUtil.java
com.okta.sdk.helper.PaginationUtil.getNextPageapi/src/main/java/com/okta/sdk/helper/PaginationUtil.java