CVE-2026-20746: PingDirectory DoS Vulnerability

CVE-2026-20746 Overview

CVE-2026-20746 is a memory exhaustion vulnerability in Ping Identity PingDirectory. The flaw exists in how the directory server handles virtual attribute copying when recent login history is enabled and virtual attributes reference ds-privilege-name values. An authenticated user with elevated privileges can trigger uncontrolled growth of the Java memory heap, leading to denial of service against the directory service. The issue is tracked under CWE-401: Missing Release of Memory after Effective Lifetime and is documented in Ping Identity Security Advisory SECADV052.

Critical Impact
Authenticated, high-privileged attackers can exhaust the Java heap of PingDirectory instances, disrupting authentication and directory services that depend on the affected server.

Affected Products

Ping Identity PingDirectory (versions prior to 11.0.0.1, March 2026 release)
PingDirectory deployments with recent login history enabled
PingDirectory configurations that copy virtual attributes referencing ds-privilege-name

Discovery Timeline

2026-06-12 - CVE-2026-20746 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2026-20746

Vulnerability Analysis

The vulnerability resides in the virtual attribute handling logic within PingDirectory. Virtual attributes are computed values returned alongside real directory entries. When recent login history is enabled, the server tracks authentication events per user and exposes them through virtual attribute facilities.

The flaw activates when virtual attributes are configured to copy values that reference the ds-privilege-name operational attribute. During request handling, the server retains references to copied attribute data that should be released after the operation completes. Repeated operations that trigger this code path cause unbounded growth of the Java Virtual Machine (JVM) heap. Eventually the JVM exhausts available memory, throws OutOfMemoryError, and the directory service becomes unresponsive.

The vulnerability requires authenticated access with high privileges and some user interaction, which limits opportunistic exploitation. However, in environments where service accounts or administrative roles are broadly distributed, a single compromised credential is sufficient to disrupt directory availability.

Root Cause

The root cause is a memory leak [CWE-401] in the virtual attribute copy implementation. References to attribute data tied to ds-privilege-name resolution are not released after request processing, preventing garbage collection from reclaiming the memory.

Attack Vector

The attack vector is network-based against the LDAP or LDAPS listener. An authenticated user issues directory operations that exercise the vulnerable virtual attribute copy path. Each operation increases heap utilization until the JVM terminates or stalls under garbage collection pressure.

No verified public proof-of-concept code is available. Refer to Ping Identity Security Advisory SECADV052 for vendor technical details.

Detection Methods for CVE-2026-20746

Indicators of Compromise

Sustained growth of PingDirectory JVM heap usage without corresponding load increase
java.lang.OutOfMemoryError: Java heap space entries in errors.log or server.out
Increasing garbage collection pause times and frequency in GC logs
Service unresponsiveness or restarts coinciding with LDAP operations that request ds-privilege-name virtual attributes

Detection Strategies

Baseline normal JVM heap consumption for each PingDirectory instance and alert on deviations beyond expected operational ranges
Audit LDAP access logs for repeated search or modify operations from a single authenticated principal that target virtual attributes referencing ds-privilege-name
Correlate authentication events with recent login history retrieval patterns to identify abnormal query frequency

Monitoring Recommendations

Enable JVM heap and garbage collection telemetry export to your observability platform
Monitor PingDirectory cn=monitor entries for memory and worker thread metrics
Alert on service restarts or process termination on directory hosts
Forward PingDirectory access and error logs to a centralized log platform for correlation with privileged account activity

How to Mitigate CVE-2026-20746

Immediate Actions Required

Upgrade PingDirectory to version 11.0.0.1 or later as published in the Ping Identity Release Notes 11.0
Review and restrict accounts holding privileges that grant access to the vulnerable virtual attribute copy operations
Audit virtual attribute configurations that reference ds-privilege-name and disable any that are not operationally required
Increase JVM heap monitoring thresholds and configure automated restart safeguards as a temporary protective measure

Patch Information

Ping Identity addressed the vulnerability in PingDirectory 11.0.0.1, released in March 2026. Installation packages are available from the Ping Identity Directory Downloads portal. Apply the upgrade following the vendor's standard PingDirectory upgrade procedure and validate replication health after the update.

Workarounds

Disable recent login history on affected PingDirectory instances if business requirements permit
Remove or reconfigure virtual attribute definitions that copy values referencing ds-privilege-name
Restrict the set of authenticated users that can perform operations against the affected attribute path through access control instructions (ACIs)

bash

# Example: disable recent login history globally in PingDirectory
dsconfig set-global-configuration-prop \
  --set maintain-recent-login-history-failed-authentication-count:false \
  --set maintain-recent-login-history-successful-authentication-count:false

# Example: review virtual attribute definitions referencing ds-privilege-name
dsconfig list-virtual-attributes \
  --property name \
  --property attribute-type \
  --property value