PT-2025-25497 · Ping Identity · Pingfederate

Published 2025-06-15 · Updated 2025-06-15 · CVE-2025-21085

Positive Technologies (AI Summary)

CVSS v4.0

2.1

Low

Base vector

AV:N/AC:L/AT:P/PR:L/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L/S:P/AU:Y/R:A/RE:L/U:Amber

Name of the Vulnerable Software and Affected Versions PingFederate (affected versions not specified)

Description The issue concerns PingFederate OAuth2 grant duplication in PostgreSQL persistent storage, allowing OAuth2 requests to use excessive memory utilization.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-462

Related Identifiers

CVE-2025-21085

Affected Products

Pingfederate

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2025-21085 · Security Note
• https://pingidentity.com/en/resources/downloads/pingfederate.html · Patch
• https://t.me/cvetracker/26256 · Telegram Post
• https://twitter.com/CVEnew/status/1934262368797606367 · Twitter Post
• https://t.me/cvenotify/125717 · Telegram Post
• https://support.pingidentity.com/s/article/PingFederate-grant-attribute-duplication-with-PostgreSQL · Note