CVE-2025-21085: PingFederate OAuth Grant attribute duplication may use excessive memory
Published Jun 15, 2025
·Updated
PingFederate OAuth2 grant duplication in PostgreSQL persistent storage allows OAuth2 requests to use excessive memory utilization.
Affected Software
1 affected component
Ping Identity PingFederate
Event History
Jun 15, 2025
CVE Published
via MITRE·02:25 PM
Data Sourced
via MITRE·02:25 PM
DescriptionWeakness
Data Sourced
via NVD·03:15 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What is the severity of CVE-2025-21085?
CVE-2025-21085 has been classified as a medium severity vulnerability.
2
How do I fix CVE-2025-21085?
To mitigate CVE-2025-21085, users should apply the latest patches provided by Ping Identity for PingFederate.
3
What are the potential impacts of CVE-2025-21085?
CVE-2025-21085 can lead to excessive memory utilization in OAuth2 requests, potentially affecting system performance.
4
Is CVE-2025-21085 exploitable remotely?
Yes, CVE-2025-21085 can be exploited remotely if the vulnerable instance of PingFederate is exposed to the internet.
5
Which versions of PingFederate are affected by CVE-2025-21085?
CVE-2025-21085 impacts specific versions of Ping Identity PingFederate that utilize PostgreSQL for persistent storage.