{"id":"CVE-2025-68137","aliases":["EUVD-2025-206317","GHSA-7qq4-q9r8-wc7w"],"status":"published","title":"EVerest's Integer Overflow and Signed to Unsigned conversion lead to either stack buffer overflow or infinite loop","description":"EVerest is an EV charging software stack. Prior to version 2025.10.0, an integer overflow occurring in `SdpPacket::parse_header()` allows the current buffer length to be set to 7 after a complete header of size 8 has been read. The remaining length to read is computed using the current length subtracted by the header length which results in a negative value. This value is then interpreted as `SIZE_MAX` (or slightly less) because the expected type of the argument is `size_t`. Depending on whether the server is plain TCP or TLS, this leads to either an infinite loop or a stack buffer overflow. Version 2025.10.0 fixes the issue.","severity":{"version":"3.1","score":8.4,"vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.01308,"percentile":0.70826,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"cwes":["CWE-120","CWE-835"],"published":"2026-01-21T19:20:09Z","modified":"2026-10-28T11:01:00Z","exploits":[{"source":"exploitdb","id":"EDB-52679","title":"EVerest 2025.9.0 - DoS","type":"dos","platform":"multiple","date":"2026-09-02","url":"https://www.exploit-db.com/exploits/52679"}],"products":[{"vendor":"everest","product":"everest-core"},{"vendor":"linuxfoundation","product":"everest"}],"references":[{"url":"https://github.com/EVerest/everest-core/security/advisories/GHSA-7qq4-q9r8-wc7w","tags":["x_refsource_CONFIRM","Exploit","Vendor Advisory","advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/68xxx/CVE-2025-68137.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-68137","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2025-68137","title":"EVerest's Integer Overflow and Signed to Unsigned conversion lead to either stack buffer overflow or infinite loop","description":"EVerest is an EV charging software stack. Prior to version 2025.10.0, an integer overflow occurring in `SdpPacket::parse_header()` allows the current buffer length to be set to 7 after a complete header of size 8 has been read. The remaining length to read is computed using the current length subtracted by the header length which results in a negative value. This value is then interpreted as `SIZE_MAX` (or slightly less) because the expected type of the argument is `size_t`. Depending on whether the server is plain TCP or TLS, this leads to either an infinite loop or a stack buffer overflow. Version 2025.10.0 fixes the issue.","status":"published","published":"2026-01-21T19:20:09.059Z","modified":"2026-01-21T19:51:26.058Z","cvss":[{"version":"3.1","score":8.4,"vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-120","CWE-835"],"updated_at":"2026-11-02T14:32:35.742256Z"}],"euvd":[{"id":"EUVD-2025-206317","description":"EVerest is an EV charging software stack. Prior to version 2025.10.0, an integer overflow occurring in `SdpPacket::parse_header()` allows the current buffer length to be set to 7 after a complete header of size 8 has been read. The remaining length to read is computed using the current length subtracted by the header length which results in a negative value. This value is then interpreted as `SIZE_MAX` (or slightly less) because the expected type of the argument is `size_t`. Depending on whether the server is plain TCP or TLS, this leads to either an infinite loop or a stack buffer overflow. Version 2025.10.0 fixes the issue.","status":"published","published":"2026-01-21T19:20:09Z","modified":"2026-01-21T19:51:26Z","cvss":[{"version":"3.1","score":8.4,"vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T19:48:49.473592Z"}],"nvd":[{"id":"CVE-2025-68137","description":"EVerest is an EV charging software stack. Prior to version 2025.10.0, an integer overflow occurring in `SdpPacket::parse_header()` allows the current buffer length to be set to 7 after a complete header of size 8 has been read. The remaining length to read is computed using the current length subtracted by the header length which results in a negative value. This value is then interpreted as `SIZE_MAX` (or slightly less) because the expected type of the argument is `size_t`. Depending on whether the server is plain TCP or TLS, this leads to either an infinite loop or a stack buffer overflow. Version 2025.10.0 fixes the issue.","status":"published","published":"2026-01-21T20:16:05.84Z","modified":"2026-06-17T09:58:34.937Z","cvss":[{"version":"3.1","score":8.3,"vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-120","CWE-835"],"updated_at":"2026-11-02T14:11:57.915063Z"}],"osv":[{"id":"CVE-2025-68137","title":"EVerest's Integer Overflow and Signed to Unsigned conversion lead to either stack buffer overflow or infinite loop","description":"EVerest is an EV charging software stack. Prior to version 2025.10.0, an integer overflow occurring in `SdpPacket::parse_header()` allows the current buffer length to be set to 7 after a complete header of size 8 has been read. The remaining length to read is computed using the current length subtracted by the header length which results in a negative value. This value is then interpreted as `SIZE_MAX` (or slightly less) because the expected type of the argument is `size_t`. Depending on whether the server is plain TCP or TLS, this leads to either an infinite loop or a stack buffer overflow. Version 2025.10.0 fixes the issue.","status":"published","published":"2026-01-21T19:20:09.059Z","modified":"2026-10-28T11:01:00.478379237Z","cvss":[{"version":"3.1","score":8.3,"vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-120","CWE-835"],"updated_at":"2026-11-02T15:44:52.53036Z"}]}}