Skip to content
CVE PROGRAM SOURCE RECORD6.5 Medium

CVE-2026-78633

Denial of Service in Okta RADIUS Agent Packet Parser

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Okta

Description

The Okta RADIUS Agent does not validate the sub-attribute length when parsing a Vendor-Specific attribute. A sub-attribute length of zero causes the parser to loop indefinitely, resulting in worker-thread exhaustion and denial of new RADIUS authentication requests.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Okta Okta RADIUS Agent

Default version status: unaffected

  • 2.17.5 to < 2.28.0affected

References