Vulnerability · Published Jan 21, 2026 · Assigned by GitHub_M

CVE-2025-68138EVerest affected by memory exhaustion in libocpp

Medium 4.7

In plain English

A medium-severity resource allocation without limits in everest-core from EVerest. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 8% of all known vulnerabilities).

Severity (CVSS 3.1)4.7Medium

Exploit odds (30 days)0.2%top 92.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

EVerest is an EV charging software stack, and EVerest libocpp is a C++ implementation of the Open Charge Point Protocol. In libocpp prior to version 0.30.1, pointers returned by the `strdup` calls are never freed. At each connection attempt, the newly allocated memory area will be leaked, potentially causing memory exhaustion and denial of service. Version 0.30.1 fixes the issue.

Affected products (as reported)

Vendor	Product	Versions
EVerest	everest-core	libocpp < 0.30.1

Weakness: CWE-770 · Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L

References

https://github.com/EVerest/everest-core/security/advisories/GHSA-f8c2-44c3-7v55 x_refsource_CONFIRM
https://github.com/EVerest/libocpp/blob/89c7b62ec899db637f43b54f19af2c4af30cfa66/lib/ocpp/common/websocket/websocket_libwebsockets.cpp x_refsource_MISC