What’s Vulnerable › Vulnerabilities
CVE-2025-68136: EVerest's inadequate session handling can lead to memory-related errors or exhaustion of the operating system’s file descriptors, resulting in a denial of service
- Severity: high (CVSS 7.4 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.3% probability of exploitation in the next 30 days
- Public exploit or detection template: yes
- Published: 2026-01-21 · updated 2026-06-17
- Weakness: CWE-770
Description
EVerest is an EV charging software stack. Prior to version 2025.10.0, once the module receives a SDP request, it creates a whole new set of objects like `Session`, `IConnection` which open new TCP socket for the ISO15118-20 communications and registers callbacks for the created file descriptor, without closing and destroying the previous ones. Previous `Session` is not saved and the usage of an `unique_ptr` is lost, destroying connection data. Latter, if the used socket and therefore file descriptor is not the last one, it will lead to a null pointer dereference. Version 2025.10.0 fixes the issue.
Affected products
- everest-core: before 2025.10.0 — fixed in 2025.10.0
How to fix
Upgrade to a fixed version: everest-core 2025.10.0. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2025-68136 or the next vulnerability affects your stack