CVE-2025-68135 EVerest's inadequate exception handling leads to denial of service

What is CVE-2025-68135?

CVE-2025-68135 is a medium-severity denial of service vulnerability in everest-core, published on 21 Jan 2026. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

EVerest is an EV charging software stack. Prior to version 2025.10.0, C++ exceptions are not properly handled for and by the `TbdController` loop, leading to its caller and itself to silently terminates. Thus, this leads to a denial of service as it is responsible of SDP and ISO15118-20 servers. Version 2025.10.0 fixes the issue.

Weakness: CWE-703

Which versions are affected by CVE-2025-68135?

It affects 1 product.

Products include Linuxfoundation Everest.

How do I fix CVE-2025-68135?

No fix has been published for CVE-2025-68135 yet. Limit exposure of the affected software until one is available.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2025-68135 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-68135 exists.

Other vulnerabilities in everest-core

• CVE-2026-22790 EVerest's unchecked SLAC payload length causes stack overflow in HomeplugMessage::setup_payload High 8.8
• CVE-2026-22593 EVerest has off-by-one stack buffer overflow in IsoMux certificate filename parsing High 8.4
• CVE-2026-23995 EVerest has stack buffer overflow in ifreq.ifr_name when interface name exceeds IFNAMSIZ High 8.4
• CVE-2025-68137 EVerest's Integer Overflow and Signed to Unsigned conversion lead to either stack buffer overflow or infinite loop High 8.4
• CVE-2026-33009 EVerest: MQTT Switch-Phases Command Data Race Causing Charger State Corruptio High 8.2

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-g7mm-r6qp-96vh.