{"id":"CVE-2025-68138","aliases":["EUVD-2025-206321","GHSA-f8c2-44c3-7v55"],"status":"published","title":"EVerest affected by memory exhaustion in libocpp","description":"EVerest is an EV charging software stack, and EVerest libocpp is a C++ implementation of the Open Charge Point Protocol. In libocpp prior to version 0.30.1, pointers returned by the `strdup` calls are never freed. At each connection attempt, the newly allocated memory area will be leaked, potentially causing memory exhaustion and denial of service. Version 0.30.1 fixes the issue.","severity":{"version":"3.1","score":4.7,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00183,"percentile":0.07919,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-770"],"published":"2026-01-21T19:30:49Z","modified":"2026-10-28T11:01:01Z","products":[{"vendor":"everest","product":"everest-core"},{"vendor":"linuxfoundation","product":"libocpp"}],"references":[{"url":"https://github.com/EVerest/everest-core/security/advisories/GHSA-f8c2-44c3-7v55","tags":["x_refsource_CONFIRM","Vendor Advisory","advisory"]},{"url":"https://github.com/EVerest/libocpp/blob/89c7b62ec899db637f43b54f19af2c4af30cfa66/lib/ocpp/common/websocket/websocket_libwebsockets.cpp","tags":["x_refsource_MISC","Product","web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/68xxx/CVE-2025-68138.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-68138","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2025-68138","title":"EVerest affected by memory exhaustion in libocpp","description":"EVerest is an EV charging software stack, and EVerest libocpp is a C++ implementation of the Open Charge Point Protocol. In libocpp prior to version 0.30.1, pointers returned by the `strdup` calls are never freed. At each connection attempt, the newly allocated memory area will be leaked, potentially causing memory exhaustion and denial of service. Version 0.30.1 fixes the issue.","status":"published","published":"2026-01-21T19:30:49.196Z","modified":"2026-01-22T21:56:29.394Z","cvss":[{"version":"3.1","score":4.7,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L","level":"medium","assessor":"cna"}],"cwes":["CWE-770"],"updated_at":"2026-11-02T14:32:36.079745Z"}],"euvd":[{"id":"EUVD-2025-206321","description":"EVerest is an EV charging software stack, and EVerest libocpp is a C++ implementation of the Open Charge Point Protocol. In libocpp prior to version 0.30.1, pointers returned by the `strdup` calls are never freed. At each connection attempt, the newly allocated memory area will be leaked, potentially causing memory exhaustion and denial of service. Version 0.30.1 fixes the issue.","status":"published","published":"2026-01-21T19:30:49Z","modified":"2026-01-22T21:56:29Z","cvss":[{"version":"3.1","score":4.7,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T19:48:48.084617Z"}],"nvd":[{"id":"CVE-2025-68138","description":"EVerest is an EV charging software stack, and EVerest libocpp is a C++ implementation of the Open Charge Point Protocol. In libocpp prior to version 0.30.1, pointers returned by the `strdup` calls are never freed. At each connection attempt, the newly allocated memory area will be leaked, potentially causing memory exhaustion and denial of service. Version 0.30.1 fixes the issue.","status":"published","published":"2026-01-21T20:16:06.007Z","modified":"2026-06-17T09:58:35.043Z","cvss":[{"version":"3.1","score":4.7,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L","level":"medium","assessor":"secondary"}],"cwes":["CWE-770"],"updated_at":"2026-11-02T14:11:57.915063Z"}],"osv":[{"id":"CVE-2025-68138","title":"EVerest affected by memory exhaustion in libocpp","description":"EVerest is an EV charging software stack, and EVerest libocpp is a C++ implementation of the Open Charge Point Protocol. In libocpp prior to version 0.30.1, pointers returned by the `strdup` calls are never freed. At each connection attempt, the newly allocated memory area will be leaked, potentially causing memory exhaustion and denial of service. Version 0.30.1 fixes the issue.","status":"published","published":"2026-01-21T19:30:49.196Z","modified":"2026-10-28T11:01:01.223480025Z","cvss":[{"version":"3.1","score":4.7,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L","level":"medium"}],"cwes":["CWE-770"],"updated_at":"2026-11-02T15:44:52.53036Z"}]}}