CVE-2026-20746: PingDirectory copying of virtual attributes leads to memory exhaustion
Published Jun 12, 2026
·Updated
Virtual attribute handling in Ping Identity PingDirectory in affected versions allows only authorized users to exhaust java memory heap when recent login history is enabled and copying virtual attributes that reference ds-privilege-name values.
Affected Software
1 affected component
Ping Identity PingDirectory
Event History
Jun 12, 2026
CVE Published
via MITRE·02:16 AM
Data Sourced
via MITRE·02:16 AM
DescriptionWeakness
Data Sourced
via NVD·04:17 AM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What is the severity of CVE-2026-20746?
CVE-2026-20746 has a medium severity score of 6.3.
2
How does CVE-2026-20746 affect PingDirectory?
CVE-2026-20746 allows authorized users to exhaust Java memory heap by copying virtual attributes that reference ds-privilege-name values.
3
Who is affected by CVE-2026-20746?
Users of Ping Identity PingDirectory with recent login history enabled are affected by CVE-2026-20746.
4
How can I mitigate CVE-2026-20746?
To mitigate CVE-2026-20746, restrict the ability to copy virtual attributes to only trusted users.
5
What are the potential impacts of CVE-2026-20746?
CVE-2026-20746 can lead to memory exhaustion and denial of service in affected systems.