CVE-2026-26074: EVerest: OCPP201 startup event_queue lock mismatch leads to std::map/std::queue data race
EVerest is an EV charging software stack. Versions prior to 2026.02.0 have a data race leading to possible std::map<std::queue> corruption. The trigger is CSMS GetLog/UpdateFirmware request (network) with an EVSE fault event (physical). This results in TSAN reports concurrent access (data race) to eventqueue. Version 2026.2.0 contains a patch.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-26074?
CVE-2026-26074 has a high severity due to the potential for data corruption in the EVerest software.
How do I fix CVE-2026-26074?
To fix CVE-2026-26074, upgrade the EVerest software to version 2026.02.0 or later.
What kind of vulnerability is CVE-2026-26074?
CVE-2026-26074 is a data race vulnerability that can lead to corruption of std::map and std::queue structures in the EVerest software.
Which versions of EVerest are affected by CVE-2026-26074?
EVerest versions prior to 2026.02.0 are affected by CVE-2026-26074.
What triggers the vulnerability CVE-2026-26074?
The vulnerability CVE-2026-26074 is triggered by a CSMS GetLog or UpdateFirmware request over the network.