CVE-2026-20746: PingDirectory copying of virtual attributes leads to memory exhaustion
Virtual attribute handling in Ping Identity PingDirectory in affected versions allows only authorized users to exhaust java memory heap when recent login history is enabled and copying virtual attributes that reference ds-privilege-name values.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Disable recent login history in the PingDirectory configuration to prevent Java heap exhaustion when virtual attribute copying occurs.
Ping Identity PingDirectory recent login history = disabled - Configuration
Prevent or disable copying of virtual attributes that reference ds-privilege-name values to avoid triggering Java heap exhaustion.
Ping Identity PingDirectory copying virtual attributes that reference ds-privilege-name values = disabled - Compensating control
Restrict the ability to copy virtual attributes and to modify recent login history to a minimal set of trusted administrators; apply access controls (ACLs/role restrictions) and network restrictions to limit who can perform these operations.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-20746?
CVE-2026-20746 has a medium severity score of 6.3.
How does CVE-2026-20746 affect PingDirectory?
CVE-2026-20746 allows authorized users to exhaust Java memory heap by copying virtual attributes that reference ds-privilege-name values.
Who is affected by CVE-2026-20746?
Users of Ping Identity PingDirectory with recent login history enabled are affected by CVE-2026-20746.
How can I mitigate CVE-2026-20746?
To mitigate CVE-2026-20746, restrict the ability to copy virtual attributes to only trusted users.
What are the potential impacts of CVE-2026-20746?
CVE-2026-20746 can lead to memory exhaustion and denial of service in affected systems.