TI-2025-15081 Aliases CVE-2025-21085 GHSA-4755-93r4-qvxj

PingFederate OAuth Grant attribute duplication may use excessive memory

LOW 11CWE-462Published 2025-06-15 · Updated 2025-06-16

Key facts

Attack vector: Network
Privileges required: Low
User interaction: Passive
Attack complexity: Low
Attack requirements: Present
Impact type: —
Confidentiality · integrity · availability: None · None · Low
Fix status: Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

PingFederate OAuth2 grant duplication in PostgreSQL persistent storage allows OAuth2 requests to use excessive memory utilization.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00337 27th percentileScored 2026-11-07

Fix Fixed PingFederate (Ping Identity): 12.2.4, 12.1.9, 12.0.9 +1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Ping Identity	PingFederate	12.2.0 to before 12.2.4; 12.1.0 to before 12.1.9; 12.0 to before 12.0.9; 11.3.0 to before 11.3.13	12.2.4, 12.1.9, 12.0.9, 11.3.13	Patch available	CNA

PingFederate VendorPing Identity Affected 12.2.0 to before 12.2.4; 12.1.0 to before 12.1.9; 12.0 to before 12.0.9; 11.3.0 to before 11.3.13 Fixed in 12.2.4, 12.1.9, 12.0.9, 11.3.13 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPE	Versions	Role	Vendor
cpe:2.3:a:pingidentity:pingfederate::::::::	—	—	Ping Identity

cpe:2.3:a:pingidentity:pingfederate:*:*:*:*:*:*:*:* Versions — — ·Ping Identity

Remediation

Fix · CNA PingFederate (Ping Identity) Fixed in 12.2.4, 12.1.9, 12.0.9, 11.3.13

Timeline

2026-10-02 Threatist record created from CVE-2025-21085
2026-10-03 Alias added: GHSA-4755-93r4-qvxj

References

Patch 1

https://www.pingidentity.com/en/resources/downloads/pingfederate.html

Other 1

https://support.pingidentity.com/s/article/PingFederate-grant-attribute-duplication-with-PostgreSQL

TI-2018-15786 UnboundID LDAP SDK version from commit 801111d8b5c732266a5dbd4b3bb0b6c7b94d7afb up to… CVSS 3.0CRITICAL 9.8
TI-2020-08561 Ping Identity PingID SSH before 4.0.14 contains a heap buffer overflow in PingID-enrolled… CVSS 3.1CRITICAL 9.8
TI-2025-14368 PingAM Java Policy Agent path traversal CVSS 4.0CRITICAL 9.2
TI-2023-21350 PingFederate OAuth client_secret_jwt Authentication Bypass CVSS 3.1CRITICAL 9.8
TI-2026-17292 Improper Claim Validation in PingAM OIDC Provider CVSS 4.0CRITICAL 9.5
TI-2023-20828 PingFederate PingID Radius PCV Authentication Bypass CVSS 3.1CRITICAL 9.8

See all 58 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences