Vulnerability in Ping Identity Pingfederate

CVE-2025-21085

PingFederate OAuth2 grant duplication in PostgreSQL persistent storage allows OAuth2 requests to use excessive memory utilization.

EPSS: 0.003 (21.3th percentile) — read the EPSS interpretation.

Affected products

Ping Identity Pingfederate — versions 12.2.0, 12.1.0, 12.0

Weakness classification (CWE)

CWE-462

References

responsible-disclosure@pingidentity.com (mitigation)
responsible-disclosure@pingidentity.com (patch)