Vulnerability in Ping Identity Pingfederate

CVE-2025-22854

Improper handling of non-200 http responses in the PingFederate Google Adapter leads to thread exhaustion under normal usage conditions.

EPSS: 0.003 (20.9th percentile) — read the EPSS interpretation.

Affected products

Ping Identity Pingfederate — versions 1.0.1

Weakness classification (CWE)

CWE-394

References

responsible-disclosure@pingidentity.com (patch)
responsible-disclosure@pingidentity.com (release-notes)