---
id: CVE-2026-78633
title: >-
  The Okta RADIUS Agent does not validate the sub-attribute length when parsing
  a Vendor-Specific attribute
summary: >-
  The Okta RADIUS Agent does not validate the sub-attribute length when parsing
  a Vendor-Specific attribute. A sub-attribute length of zero causes the parser
  to loop indefinitely, resulting in worker-thread exhaustion and denial of new
  RAD…
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'
cwe:
  - CWE-835
published: '2026-10-13'
updated: '2026-10-13'
sourceUpdated: '2026-10-13T21:18:21.853'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-78633'
references:
  - url: >-
      https://trust.okta.com/security-advisories/denial-of-service-in-okta-radius-agent-packet-parser-cve-2026-78633
    label: psirt@okta.com
tags:
  - nvd
ingestedAt: '2026-10-13T21:58:14.189Z'
---

## Overview

The Okta RADIUS Agent does not validate the sub-attribute length when parsing a Vendor-Specific attribute. A sub-attribute length of zero causes the parser to loop indefinitely, resulting in worker-thread exhaustion and denial of new RADIUS authentication requests.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.