CVE-2026-20746

6.3 Moyenne

Publiée le 12/06/2026 à 06:17 · Modifiée le 29/08/2026 à 00:16 · En attente d'analyse NVD · Source : responsible-disclosure@pingidentity.com

Description

Virtual attribute handling in Ping Identity PingDirectory in affected versions allows only authorized users to exhaust java memory heap when recent login history is enabled and copying virtual attributes that reference ds-privilege-name values.

Traduire en français

Produits concernés

Ping Identity PingDirectory

Scores CVSS

Version	Score	Source	Vecteur
4.0	6.3 Moyenne	responsible-disclosure@pingidentity.com	`CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:L/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:P/AU:Y/R:U/V:X/RE:M/U:Amber`

Faiblesses (CWE)

CWE-401

Références

https://docs.pingidentity.com/pingdirectory/11.0/release_notes/pd_release_notes.html#pingdirectory-suite-of-products-11-0-0-1-march-2026
https://support.pingidentity.com/s/article/SECADV052-Denial-of-Service-via-copying-virtual-attributes
https://www.pingidentity.com/en/resources/downloads/pingdirectory-downloads.html

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories