Vulnerability · Published Oct 13, 2026 · Assigned by Okta
CVE-2026-78633Denial of Service in Okta RADIUS Agent Packet Parser
Medium 6.5
In plain English
A medium-severity infinite loop in Okta RADIUS Agent from Okta. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 11% of all known vulnerabilities).
Severity (CVSS 3.1)6.5Medium
Exploit odds (30 days)0.2%top 89.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
The Okta RADIUS Agent does not validate the sub-attribute length when parsing a Vendor-Specific attribute. A sub-attribute length of zero causes the parser to loop indefinitely, resulting in worker-thread exhaustion and denial of new RADIUS authentication requests.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Okta | Okta RADIUS Agent | 2.17.5 – before 2.28.0 |
Weakness: CWE-835 · Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H