CVE-2025-22854: Ping Identity Pingfederate

Medium severity, CVSS 6.9. EPSS: 0.3% chance of exploitation in the next 30 days.

Improper handling of non-200 http responses in the PingFederate Google Adapter leads to thread exhaustion under normal usage conditions.

Affected products

• Ping Identity Pingfederate: from 1.0.1, before 1.5.2 (fixed in 1.5.2)

Published 2025-06-15. Last modified 2026-06-17.