Java Management Sdk
Monthly
Okta Java SDK versions 11.0.0 through 20.0.0 allow concurrent ApiClient requests to cross-contaminate response status codes and headers, which can undermine access-control decisions in multithreaded applications. This is a timing-dependent race condition (CWE-362) that is not remotely exploitable against default deployments; exploitation requires an application that invokes ApiClient concurrently and bases authorization on its response status or headers. No public exploit or active exploitation has been identified, and EPSS is low at 0.21%, but a vendor patch is available in version 20.0.1 (GHSA text says 21.0.0+).
Memory and thread resource exhaustion in the Okta Java Management SDK 21.0.0 through 24.0.0 allows long-running, multithreaded applications to progressively degrade and eventually suffer a denial-of-service condition against themselves, because threads are not properly cleaned up after requests complete. Only applications that integrate the SDK's ApiClient in a multithreaded manner and run for extended periods under sustained load are at risk; short-lived processes, single-threaded integrations, and applications on 24.0.1 or later are unaffected. This is not an attacker-triggerable flaw but an availability defect that surfaces through the application's own normal operation, rated CVSS 5.3 (AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H) with a very low EPSS of 0.27% (17th percentile); no public exploit code or confirmed active exploitation has been identified at time of analysis, and this is a low-real-priority availability issue despite the network attack vector.
Okta Java SDK versions 11.0.0 through 20.0.0 allow concurrent ApiClient requests to cross-contaminate response status codes and headers, which can undermine access-control decisions in multithreaded applications. This is a timing-dependent race condition (CWE-362) that is not remotely exploitable against default deployments; exploitation requires an application that invokes ApiClient concurrently and bases authorization on its response status or headers. No public exploit or active exploitation has been identified, and EPSS is low at 0.21%, but a vendor patch is available in version 20.0.1 (GHSA text says 21.0.0+).
Memory and thread resource exhaustion in the Okta Java Management SDK 21.0.0 through 24.0.0 allows long-running, multithreaded applications to progressively degrade and eventually suffer a denial-of-service condition against themselves, because threads are not properly cleaned up after requests complete. Only applications that integrate the SDK's ApiClient in a multithreaded manner and run for extended periods under sustained load are at risk; short-lived processes, single-threaded integrations, and applications on 24.0.1 or later are unaffected. This is not an attacker-triggerable flaw but an availability defect that surfaces through the application's own normal operation, rated CVSS 5.3 (AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H) with a very low EPSS of 0.27% (17th percentile); no public exploit code or confirmed active exploitation has been identified at time of analysis, and this is a low-real-priority availability issue despite the network attack vector.