CVE-2025-66033: 
Java vulnerability analysis and mitigation

CVE-2025-66033 is a memory leak vulnerability ("Improper Memory Cleanup") in the Okta Java Management SDK affecting versions 21.0.0 through 24.0.0. In multithreaded implementations, threads are not properly cleaned up after API requests complete, causing memory to accumulate over time in long-running applications. The vulnerability was discovered by Andrew Pikler (pyckle) and disclosed on December 10, 2025, with a patch released the same day. It carries a CVSS v3.1 base score of 5.3 (Medium) (GitHub Advisory, Github Advisory).

The root cause is classified as CWE-401 (Missing Release of Memory after Effective Lifetime): the ApiClient class in the SDK fails to properly clean up threads after completing API requests in multithreaded contexts. The legacy PaginationUtil.getAfter() approach stored pagination metadata in thread-local state, and when multiple threads shared an ApiClient instance, threads were not released after request completion, causing progressive memory accumulation. Exploitation requires an attacker to sustain a high volume of concurrent network requests against a long-running application using the affected ApiClient in a multithreaded manner. The fix introduced a new thread-safe PagedIterable/PagedIterator pattern with isolated per-iterator state, and an immutable ApiResponse object replacing the shared mutable header map (GitHub Advisory, Patch Commit).

Successful exploitation results in gradual performance degradation and eventual denial-of-service (DoS) in long-running Java applications that use the Okta Java Management SDK in a multithreaded manner. As threads accumulate without being released, system memory is progressively exhausted under sustained load, ultimately rendering the application unavailable. There is no impact on confidentiality or data integrity — the vulnerability is limited to availability (Github Advisory).

The primary remediation is to upgrade the Okta Java Management SDK (com.okta.sdk:okta-sdk-root) to version 24.0.1 or later, which introduces the thread-safe PagedIterable pagination pattern and fixes the thread cleanup issue (GitHub Advisory). Organizations that cannot immediately upgrade should migrate away from the legacy PaginationUtil.getAfter() approach and consider implementing request throttling or load balancing to reduce sustained concurrent request volumes. The deprecated PaginationUtil.getAfter() method is scheduled for removal in v26.0.0, and migration to the *Paged() methods (e.g., listUsersPagedIterable()) is strongly recommended for all users (okta-sdk-java Repo).

Okta credited Andrew Pikler (pyckle) for responsible disclosure of the vulnerability in the official security advisory. No significant broader media coverage or notable researcher commentary beyond the official advisory has been identified (GitHub Advisory).