CVE-2025-68136

HighCVSS 7.4/10Last modified Jun 17, 2026

Description

EVerest is an EV charging software stack. Prior to version 2025.10.0, once the module receives a SDP request, it creates a whole new set of objects like `Session`, `IConnection` which open new TCP socket for the ISO15118-20 communications and registers callbacks for the created file descriptor, without closing and destroying the previous ones. Previous `Session` is not saved and the usage of an `unique_ptr` is lost, destroying connection data. Latter, if the used socket and therefore file descriptor is not the last one, it will lead to a null pointer dereference. Version 2025.10.0 fixes the issue.

Metrics

CVSS 3.1 7.4/10CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

Weakness enumeration

CWE-770

Affected software

No affected versions have been published.

Timeline

Published: Jan 21, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-681378.3EVerest is an EV charging software stack. Prior to version 2025.10.0, an integer overflow occurring in `SdpPacket::parse_header()` allows th CVE-2025-681384.7EVerest is an EV charging software stack, and EVerest libocpp is a C++ implementation of the Open Charge Point Protocol. In libocpp prior to CVE-2025-681394.3EVerest is an EV charging software stack. In all versions up to and including 2025.12.1, the default value for `terminate_connection_on_fail CVE-2025-68147.5The Booking X plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the export_now() functi CVE-2025-681404.3EVerest is an EV charging software stack. Prior to version 2025.9.0, once the validity of the received V2G message has been verified, it is CVE-2025-681417.4EVerest is an EV charging software stack. Prior to version 2025.10.0, during the deserialization of a `DC_ChargeLoopRes` message that includ CVE-2025-681425.3PyMdown Extensions is a set of extensions for the `Python-Markdown` markdown project. Versions prior to 10.16.1 have a ReDOS bug found withi CVE-2025-681438.8Model Context Protocol Servers is a collection of reference implementations for the model context protocol (MCP). In mcp-server-git versions CVE-2025-681447.1In mcp-server-git versions prior to 2025.12.17, the git_diff and git_checkout functions passed user-controlled arguments directly to git CLI CVE-2025-681459.1In mcp-server-git versions prior to 2025.12.17, when the server is started with the --repository flag to restrict operations to a specific r CVE-2025-681466.5filelock is a platform-independent file lock for Python. In versions prior to 3.20.1, a Time-of-Check-Time-of-Use (TOCTOU) race condition al CVE-2025-681478.1Open Source Point of Sale (opensourcepos) is a web based point of sale application written in PHP using CodeIgniter framework. Starting in v