This vulnerability in Ping Identity PingDirectory affects specific versions (9.3.0.0, 10.2.0.0, 10.3.0.0, and 11.0.0.0) and arises from improper memory management (CWE-401) in virtual attribute handling. When recent login history is enabled and virtual attributes referencing ds-privilege-name values are copied, authorized users can cause exhaustion of the Java memory heap. The CVSS 4.0 score is 6.3 (medium severity), indicating a network attack vector with low attack complexity but requiring privileged user access and partial user interaction. The vulnerability does not affect confidentiality, integrity, or availability directly but impacts resource consumption.

Authorized users can exploit this vulnerability to exhaust the Java memory heap on affected PingDirectory instances, potentially leading to degraded performance or denial of service due to memory exhaustion. There is no indication of direct impact on data confidentiality or integrity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary mitigation has been documented at this time. Until a patch is available, limit privileged user access and monitor for unusual memory consumption patterns related to virtual attribute operations.