CVE-2025-68138: EVerest affected by memory exhaustion in libocpp

Severity: medium (CVSS 4.7 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-01-21 · updated 2026-06-17
Weakness: CWE-770

Description

EVerest is an EV charging software stack, and EVerest libocpp is a C++ implementation of the Open Charge Point Protocol. In libocpp prior to version 0.30.1, pointers returned by the `strdup` calls are never freed. At each connection attempt, the newly allocated memory area will be leaked, potentially causing memory exhaustion and denial of service. Version 0.30.1 fixes the issue.

Affected products

EVerest libocpp: before 0.30.1 — fixed in 0.30.1

How to fix

Upgrade to a fixed version: EVerest libocpp 0.30.1. Check the vendor advisory for mitigations.

References

https://github.com/EVerest/everest-core/security/advisories/GHSA-f8c2-44c3-7v55
https://github.com/EVerest/libocpp/blob/89c7b62ec899db637f43b54f19af2c4af30cfa66/lib/ocpp/common/websocket/websocket_libwebsockets.cpp

Get alerted when CVE-2025-68138 or the next vulnerability affects your stack