CVE-2026-26072: EVerest has race-condition-induced std::map corruption in OCPP 1.6 evse_soc_map
EVerest is an EV charging software stack. Versions prior to 2026.02.0 have a data race leading to std::map<std::optional> concurrent access (container/optional corruption possible). The trigger is EV SoC update with powermeter periodic update and unplugging/SessionFinished status. Version 2026.02.0 patches the issue.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-26072?
CVE-2026-26072 has been classified with a high severity due to potential data corruption risks.
How do I fix CVE-2026-26072?
To fix CVE-2026-26072, upgrade to EVerest versions 2026.02.0 or later that address the race condition.
What causes the vulnerability in CVE-2026-26072?
CVE-2026-26072 is caused by a race condition leading to concurrent access issues in the std::map, specifically during EV SoC updates.
Which versions of EVerest are affected by CVE-2026-26072?
EVerest versions prior to 2026.02.0 are affected by CVE-2026-26072, exposing the software to race-condition-induced std::map corruption.
What are the potential impacts of CVE-2026-26072?
The potential impacts of CVE-2026-26072 include data corruption, which may affect the stability and performance of the EV charging service.