PingFederate and PingAccess
CVE-2024-23316: PingAccess HTTP Request Desynchronization Weakness
HTTP request desynchronization in Ping Identity PingAccess, all versions prior to 8.0.1 affected allows an attacker to send specially crafted http header requests to create a request smuggling condition for proxied requests.
Published
Automatic summary from the vendor's CVE record. We haven't written a full analysis of this vulnerability yet.
Affected and fixed versions
| Product / branch | Fixed in |
|---|---|
| PingAccess 0 | 8.0.1 or later |
Always confirm against the vendor advisory, which lists every fixed hotfix.
What it is
HTTP request desynchronization in Ping Identity PingAccess, all versions prior to 8.0.1 affected allows an attacker to send specially crafted http header requests to create a request smuggling condition for proxied requests.
Sources
KEV status, EPSS score and vendor data refreshed automatically, last on 13 Oct 2026.