← Vulnerability feed

Vulnerability record · CVE-2025-68133 · published 21 January 2026

CVE-2025-68133: Linuxfoundation everest allocation without limits vulnerability

Linuxfoundation · Everest

EVerest is an EV charging software stack. In versions 2025.9.0 and below, an attacker can exhaust the operating system's memory and cause the module to terminate by initiating an unlimited number of TCP connections that never proceed to ISO 15118-2 communication. This is possible because a new thread is started for each incoming plain TCP or TLS socket connection before any verification occurs, and the verification performed is too permissive. The EVerest processes and all its modules shut down, affecting all EVSE functionality. This issue is fixed in version 2025.10.0.

7.4 CVSS 3.1 High EPSS 0.39% · top 69.6% CWE-770 · Allocation without limits
7.4CVSS 3.1 base score
0.39%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
3References, 1 tagged exploit
17 Jun 2026Last modified by NVD

Description

EVerest is an EV charging software stack. In versions 2025.9.0 and below, an attacker can exhaust the operating system's memory and cause the module to terminate by initiating an unlimited number of TCP connections that never proceed to ISO 15118-2 communication. This is possible because a new thread is started for each incoming plain TCP or TLS socket connection before any verification occurs, and the verification performed is too permissive. The EVerest processes and all its modules shut down, affecting all EVSE functionality. This issue is fixed in version 2025.10.0.

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://github.com/EVerest/everest-core/commit/8127b8c54b296c4dd01b356ac26763f81f76a8fd Patch
https://github.com/EVerest/everest-core/commit/de504f0c11069010d26767b0952739e9a400cef3 Patch
https://github.com/EVerest/everest-core/security/advisories/GHSA-mv3w-pp85-5h7c ExploitVendor Advisory

Track CVE-2025-68133 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

8.8CVE-2026-22790Linuxfoundation everest stack-based buffer overflow vulnerabilityEVerest is an EV charging software stack. Prior to version 2026.02.0, `HomeplugMessage::setup_payload` trusts `len` after an `assert`; in release bui…EPSS 0.53%8.3CVE-2025-68137Linuxfoundation everest classic buffer overflow vulnerabilityEVerest is an EV charging software stack. Prior to version 2025.10.0, an integer overflow occurring in `SdpPacket::parse_header()` allows the current…EPSS 1.3%7.8CVE-2026-23995Linuxfoundation everest stack-based buffer overflow vulnerabilityEVerest is an EV charging software stack. Prior to version 2026.02.0, stack-based buffer overflow in CAN interface initialization: passing an interfa…EPSS 0.21%7.8CVE-2026-22593Linuxfoundation everest vulnerabilityEVerest is an EV charging software stack. Prior to version 2026.02.0, an off-by-one check in IsoMux certificate filename handling causes a stack-base…EPSS 0.14%7.5CVE-2026-26008Linuxfoundation everest out-of-bounds read vulnerabilityEVerest is an EV charging software stack. Versions prior to 2026.02.0 have an out-of-bounds access (std::vector) that leads to possible remote crash/…EPSS 0.46%7.4CVE-2025-68141Linuxfoundation everest null pointer dereference vulnerabilityEVerest is an EV charging software stack. Prior to version 2025.10.0, during the deserialization of a `DC_ChargeLoopRes` message that includes Receip…EPSS 0.27%7.4CVE-2025-68136Linuxfoundation everest allocation without limits vulnerabilityEVerest is an EV charging software stack. Prior to version 2025.10.0, once the module receives a SDP request, it creates a whole new set of objects l…EPSS 0.30%7.4CVE-2025-68134Linuxfoundation everest improper input validation vulnerabilityEVerest is an EV charging software stack. Prior to version 2025.10.0, the use of the `assert` function to handle errors frequently causes the module …EPSS 0.17%

Source: NIST National Vulnerability Database (record CVE-2025-68133), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.