CVEvulnerability

CVE-2026-20746

6.3 MEDIUM Published 2026-06-12 Modified 2026-10-26 Official page ↗

Status: Awaiting Analysis
Published: 2026-06-12
Last modified: 2026-10-26
Assigner: [email protected]
CVSS 4.0 ([email protected]): 6.3 MEDIUM — CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:L/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:P/AU:Y/R:U/V:X/RE:M/U:Amber
Weaknesses: CWE-401

Description

Virtual attribute handling in Ping Identity PingDirectory in affected versions allows only authorized users to exhaust java memory heap when recent login history is enabled and copying virtual attributes that reference ds-privilege-name values.

Weakness · CWE (1)

CWE-401 Missing Release of Memory after Effective Lifetime weakness

References

https://docs.pingidentity.com/pingdirectory/11.0/release_notes/pd_release_notes.html#pingdirectory-suite-of-products-11-0-0-1-march-2026 docs.pingidentity.com
https://support.pingidentity.com/s/article/SECADV052-Denial-of-Service-via-copying-virtual-attributes support.pingidentity.com
https://www.pingidentity.com/en/resources/downloads/pingdirectory-downloads.html www.pingidentity.com

CVE-2026-20746

Description

Related

Weakness · CWE (1)

References