CVE-2026-78633: Denial of Service in Okta RADIUS Agent Packet Parser
The Okta RADIUS Agent does not validate the sub-attribute length when parsing a Vendor-Specific attribute. A sub-attribute length of zero causes the parser to loop indefinitely, resulting in worker-thread exhaustion and denial of new RADIUS authentication requests.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Okta RADIUS Agentto a version that resolves this vulnerability.Fixed in 2.28.0
Event History
Frequently Asked Questions
Who can exploit this issue?
An unauthenticated attacker with adjacent network access can exploit it. No user interaction or privileges are required.
What traffic is required to trigger the denial of service?
The attacker must send a RADIUS packet containing a Vendor-Specific attribute with a sub-attribute length of zero. This causes the packet parser to loop indefinitely.
What is the operational impact?
Affected worker threads can be exhausted, preventing the agent from processing new RADIUS authentication requests. The reported impact is availability only; no confidentiality or integrity impact is listed.