CVE-2025-68136: everest everest-core

Vulnerability summary

CVE-2025-68136 is a high (CVSS 7.4) vulnerability in everest everest-core. EPSS estimates a 0.30% chance of exploitation in the next 30 days, higher than 21.4% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 21-01-2026
   PublishedVulnerability first disclosed.
2. 21-01-2026
   Last modifiedVulnerability information updated.

Description

EVerest is an EV charging software stack. Prior to version 2025.10.0, once the module receives a SDP request, it creates a whole new set of objects like `Session`, `IConnection` which open new TCP socket for the ISO15118-20 communications and registers callbacks for the created file descriptor, without closing and destroying the previous ones. Previous `Session` is not saved and the usage of an `unique_ptr` is lost, destroying connection data. Latter, if the used socket and therefore file descriptor is not the last one, it will lead to a null pointer dereference. Version 2025.10.0 fixes the issue.

• CWE-770Allocation of Resources Without Limits or ThrottlingThe product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.