CVE-2026-26071: EVerest: OCPP 2.0.1 EVCCID Data Race Leads to Heap Use‑After‑Free
EVerest is an EV charging software stack. Versions prior to 2026.02.0 have a data race leading to std::string concurrent access. with heap-use-after-free possible. This is triggered by EVCCID update (EV/ISO15118) and OCPP session/authorization events. Version 2026.02.0 contains a patch.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-26071?
CVE-2026-26071 is considered a high severity vulnerability due to its potential to cause heap use-after-free conditions.
How do I fix CVE-2026-26071?
To fix CVE-2026-26071, upgrade your EVerest software to version 2026.02.0 or later.
What causes CVE-2026-26071?
CVE-2026-26071 is caused by a data race leading to concurrent access to std::string that results in heap use-after-free.
Is my version of EVerest affected by CVE-2026-26071?
Yes, any version of EVerest prior to 2026.02.0 is affected by CVE-2026-26071.
What systems are impacted by CVE-2026-26071?
CVE-2026-26071 impacts systems utilizing the EVerest software stack for EV charging, particularly in the context of OCPP sessions.