CVE-2026-20746CWE-401

CVE-2026-20746

published June 12, 2026

CVSS
6.3
EPSS
0%
Percentile
19.2
In the wild
Unconfirmed
What it is

Virtual attribute handling in Ping Identity PingDirectory in affected versions allows only authorized users to exhaust java memory heap when recent login history is enabled and copying virtual attributes that reference ds-privilege-name values.

The record
Technical detail
CVSS
6.3 · NONE
CVSS v4.0
Not supplied
EPSS
0.00278 · 19.2th percentile
Weakness
CWE-401 · Missing Release of Memory after Effective Lifetime
Published
2026-06-12T08:17Z
References (3)
https://docs.pingidentity.com/pingdirectory/11.0/release_notes/pd_release_notes.html#pingdirectory-suite-of-products-11-0-0-1-march-2026 · [email protected]https://support.pingidentity.com/s/article/SECADV052-Denial-of-Service-via-copying-virtual-attributes · [email protected]https://www.pingidentity.com/en/resources/downloads/pingdirectory-downloads.html · [email protected]
EPSS history
Timeline
  • 12 JUN 02:16Z
    PingDirectory copying of virtual attributes leads to memory exhaustion
    cvelistv5