The Okta RADIUS Agent fails to validate the length of sub-attributes in a Vendor-Specific RADIUS attribute; a zero-length sub-attribute causes the packet parser to enter an infinite loop, exhausting worker threads and preventing new RADIUS authentication requests. This leads to a denial of service against the RADIUS service and any dependent applications that rely on it.

The affected product is the Okta RADIUS Agent. No specific product versions are listed in the advisories, so all current deployments of the Okta RADIUS Agent are potentially vulnerable until they are upgraded to version 2.28.0 or later.

The CVSS score of 6.5 indicates a moderate severity, but the EPSS score of less than 1% suggests a low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. Based on the nature of the flaw, the likely attack vector would be a malicious RADIUS client or an attacker sending crafted RADIUS packets to the server; however, this is inferred from the description rather than explicitly stated.