Medium severity · published Dec 10, 2025
CVE-2025-66033
Improper Memory Cleanup in the Okta Java SDK
5.3
CVSS
0.3%
EPSS
No
On KEV
Description
Okta Java Management SDK facilitates interactions with the Okta management API. In versions 21.0.0 through 24.0.0, specific multithreaded implementations may encounter memory issues as threads are not properly cleaned up after requests are completed. Over time, this can degrade performance and availability in long-running applications and may result in a denial-of-service condition under sustained load. In addition to using the affected versions, users may be at risk if they are implementing a long-running application using the ApiClient in a multi-threaded manner. This issue is fixed in version 24.0.1.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
High
Privileges
Low
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 19% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OK
okta-sdk-java · okta
>= 21.0.0, < 24.0.1 · source: vendor
JM
Java Management Sdk · Okta
21.0.0 before 24.0.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-66033
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-66033
Patch
https://github.com/okta/okta-sdk-java/commit/1daa9229a70fc38fb252aeaa637f82d0b0729b3f
Vendor Advisory
https://github.com/okta/okta-sdk-java/security/advisories/GHSA-qhr6-6cgv-6638
More from okta-sdk-java
8.4
CVE-2025-67505
Race condition in the Okta Java SDK
