Virtual attribute handling in Ping Identity PingDirectory allows authorized users to exhaust the Java memory heap when recent login history is enabled and virtual attributes that reference ds-privilege-name values are copied. This results in memory exhaustion, potentially causing the application to become unresponsive and leading to a denial‑of‑service condition.

Ping Identity – PingDirectory is the affected product. Specific affected versions are not listed in the CVE data; customers should verify if their deployment includes a PingDirectory version prior to the latest security release.

The vulnerability carries a CVSS score of 6.3, indicating moderate severity. The EPSS score is not available, and the vulnerability is not in the CISA KEV catalog, suggesting limited known exploitation activity. Attackers need authenticated access with rights to copy virtual attributes and recent login history must be enabled. Successful exploitation can consume heap memory until the application crashes or stalls.