PingAM, PingIDM and PingGateway
CVE-2026-20746: PingDirectory copying of virtual attributes leads to memory exhaustion
Virtual attribute handling in Ping Identity PingDirectory in affected versions allows only authorized users to exhaust java memory heap when recent login history is enabled and copying virtual attributes that reference ds-privilege-name values.
Published
Automatic summary from the vendor's CVE record. We haven't written a full analysis of this vulnerability yet.
Affected and fixed versions
| Product / branch | Fixed in |
|---|---|
| PingDirectory 9.3.0.0 to 9.3.0.8 | Upgrade past 9.3.0.8; see the advisory |
| PingDirectory 10.1.0.0 to 10.1.0.5 | Upgrade past 10.1.0.5; see the advisory |
| PingDirectory 10.2.0.0 to 10.2.0.5 | Upgrade past 10.2.0.5; see the advisory |
| PingDirectory 10.3.0.0 to 10.3.0.3 | Upgrade past 10.3.0.3; see the advisory |
| PingDirectory 11.0 | 11.0.0.1 or later |
Always confirm against the vendor advisory, which lists every fixed hotfix.
What it is
Virtual attribute handling in Ping Identity PingDirectory in affected versions allows only authorized users to exhaust java memory heap when recent login history is enabled and copying virtual attributes that reference ds-privilege-name values.
Sources
KEV status, EPSS score and vendor data refreshed automatically, last on 13 Oct 2026.