Resource exhaustion in Everest Everest-Core
CVE-2025-68133
EVerest is an EV charging software stack. In versions 2025.9.0 and below, an attacker can exhaust the operating system's memory and cause the module to terminate by initiating an unlimited number of TCP connections that never proceed to ISO 15118-2 communication. This is possible because a new thread is started for each incoming plain TCP or TLS socket connection before any verification occurs, and the verification performed is too permissive. The EVerest processes and all its modules shut down, affecting all EVSE functionality. This issue is fixed in version 2025.10.0.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 7.4 (High). Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H.
EPSS exploit prediction
EPSS: 0.004 (30.4th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 30th percentile — 30.4% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.004 · newest: 0.004 · change: +0.000
Affected products
- Everest Everest-Core — versions < 2025.10.0
- Linuxfoundation Everest
Weakness classification (CWE)
References
Frequently asked questions
- What is CVE-2025-68133?
- CVE-2025-68133 is a high-severity vulnerability in Everest Everest-Core, classified under Allocation of Resources Without Limits or Throttling. CVSS score: 7.4/10. Published 2026-01-21.
- How severe is CVE-2025-68133?
- High severity. CVSS v3 base score is 7.4 out of 10.