CVE-2025-21085

published 2025-06-15

CVE-2025-21085: PingFederate OAuth2 grant duplication in PostgreSQL persistent storage allows OAuth2 requests to use excessive memory utilization.

Priority P4 12 low 2.1 CVSS 4.0

AV N AC L AT P PR L UI P VC N VI N VA L SC N SI N SA L E X CR X IR X AR X MAV X MAC X MAT X MPR X MUI X MVC X MVI X MVA X MSC X MSI X MSA X S P AU Y R A V X RE L U Amber

PingFederate OAuth2 grant duplication in PostgreSQL persistent storage allows OAuth2 requests to use excessive memory utilization.

Affected

4 ranges

Vendor	Product	Version range	Fixed in
ping_identity	pingfederate	>= 11.3.0 < 11.3.13	11.3.13
ping_identity	pingfederate	>= 12.0 < 12.0.9	12.0.9
ping_identity	pingfederate	>= 12.1.0 < 12.1.9	12.1.9
ping_identity	pingfederate	>= 12.2.0 < 12.2.4	12.2.4

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-462