CVE-2025-68138 EVerest affected by memory exhaustion in libocpp
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2025-68138?
CVE-2025-68138 is a medium-severity vulnerability in everest-core, published on 21 Jan 2026.
Official description
EVerest is an EV charging software stack, and EVerest libocpp is a C++ implementation of the Open Charge Point Protocol. In libocpp prior to version 0.30.1, pointers returned by the `strdup` calls are never freed. At each connection attempt, the newly allocated memory area will be leaked, potentially causing memory exhaustion and denial of service. Version 0.30.1 fixes the issue.
Weakness: CWE-770
Which versions are affected by CVE-2025-68138?
It affects 1 product.
Products include Linuxfoundation Libocpp.
How do I fix CVE-2025-68138?
No fix has been published for CVE-2025-68138 yet. Limit exposure of the affected software until one is available.
Is CVE-2025-68138 being exploited?
There is no known exploitation of CVE-2025-68138 in the wild and no public exploit code.
Sources
Also known as GHSA-f8c2-44c3-7v55.