CVE-2026-20746
PingDirectory copying of virtual attributes leads to memory exhaustion
- State
- Published
- Severity
- 6.3 Medium
- Published
- Jun 12, 2026
- Updated
- Aug 28, 2026
- Reserved
- Jan 7, 2026
Description
Virtual attribute handling in Ping Identity PingDirectory in affected versions allows only authorized users to exhaust java memory heap when recent login history is enabled and copying virtual attributes that reference ds-privilege-name values.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 6.3 Medium | CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:L/SC:H/SI:H/SA:H/S:P/AU:Y/R:U/RE:M/U:Amber | Ping Identity |
Weaknesses
- CWE-401 Missing release of memory after effective lifetime
Affected Products
| Product | Versions |
|---|---|
PingDirectoryPing Identity |
|
References
- https://docs.pingidentity.com/pingdirectory/11.0/release_notes/pd_release_notes.html#pingdirectory-suite-of-products-11-0-0-1-march-2026
- https://www.pingidentity.com/en/resources/downloads/pingdirectory-downloads.html
- https://support.pingidentity.com/s/article/SECADV052-Denial-of-Service-via-copying-virtual-attributes
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.