CVE-2025-68138 - CVE House
Back to Database
Status published Medium CVE-2025-68138

EVerest affected by memory exhaustion in libocpp

Vulnerability Description

EVerest is an EV charging software stack, and EVerest libocpp is a C++ implementation of the Open Charge Point Protocol. In libocpp prior to version 0.30.1, pointers returned by the `strdup` calls are never freed. At each connection attempt, the newly allocated memory area will be leaked, potentially causing memory exhaustion and denial of service. Version 0.30.1 fixes the issue.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-68138

Credits & Attribution

No credits recorded in the NVD database.

References

More from EVerest

View All →
CVE-2025-68141
EVerest vulnerable to null pointer dereference during DC_ChargeLoopRes document deserialization
High 7.4
CVE-2025-68140
EVerest allows null session ID to bypass session ID verification
Medium 4.3
CVE-2025-68139
In EVerest, by default, the EV is responsible for closing the connection if the module encounters an error during request processing
Medium 4.3
CVE-2025-68137
EVerest's Integer Overflow and Signed to Unsigned conversion lead to either stack buffer overflow or infinite loop
High 8.4
CVE-2025-68136
EVerest's inadequate session handling can lead to memory-related errors or exhaustion of the operating system’s file descriptors, resulting in a denial of service
High 7.4

Affected Vendor

Affected Software

everest-core
Vulnerable Versions:
libocpp < 0.30.1

Timeline

Official Publish: January 21st, 2026
Last Modified: January 22nd, 2026
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L

Weaknesses (CWE)

CWE-770

MITRE ATT&CK TTPs

T1499 Endpoint Denial of Service
Impact
T1498 Network Denial of Service
Impact
T1190 Exploit Public-Facing Application
Initial Access
T1562 Impair Defenses
Defense Evasion
T1046 Network Service Discovery
Discovery