CVE-2025-68136: EVerest's inadequate session handling can lead to memory-related errors or exhaustion of the operating system’s file descriptors, resulting in a denial of service
EVerest is an EV charging software stack. Prior to version 2025.10.0, once the module receives a SDP request, it creates a whole new set of objects like Session, IConnection which open new TCP socket for the ISO15118-20 communications and registers callbacks for the created file descriptor, without closing and destroying the previous ones. Previous Session is not saved and the usage of an uniqueptr is lost, destroying connection data. Latter, if the used socket and therefore file descriptor is not the last one, it will lead to a null pointer dereference. Version 2025.10.0 fixes the issue.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-68136?
CVE-2025-68136 has been classified as a high severity vulnerability due to its potential to cause denial of service.
How do I fix CVE-2025-68136?
To remediate CVE-2025-68136, upgrade EVerest to version 2025.10.0 or later where the vulnerability is addressed.
What types of issues does CVE-2025-68136 cause?
CVE-2025-68136 can lead to memory-related errors or exhaustion of the operating system’s file descriptors.
Which versions of EVerest are affected by CVE-2025-68136?
EVerest versions prior to 2025.10.0 are affected by CVE-2025-68136.
What is the main cause of vulnerability CVE-2025-68136?
The main cause of CVE-2025-68136 is inadequate session handling in EVerest.