CVE-2026-26071 EVerest: OCPP 2.0.1 EVCCID Data Race Leads to Heap Use‑After‑Free

What is CVE-2026-26071?

CVE-2026-26071 is a medium-severity use after free vulnerability in everest-core, published on 26 Mar 2026. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

EVerest is an EV charging software stack. Versions prior to 2026.02.0 have a data race leading to `std::string` concurrent access. with heap-use-after-free possible. This is triggered by EVCCID update (EV/ISO15118) and OCPP session/authorization events. Version 2026.02.0 contains a patch.

Weakness: CWE-416, CWE-362

Which versions are affected by CVE-2026-26071?

It affects 1 product.

Products include Linuxfoundation Everest.

How do I fix CVE-2026-26071?

No fix has been published for CVE-2026-26071 yet. Limit exposure of the affected software until one is available.

Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.

Is CVE-2026-26071 being exploited?

There is no known exploitation of CVE-2026-26071 in the wild and no public exploit code.

Other vulnerabilities in everest-core

• CVE-2026-22790 EVerest's unchecked SLAC payload length causes stack overflow in HomeplugMessage::setup_payload High 8.8
• CVE-2026-22593 EVerest has off-by-one stack buffer overflow in IsoMux certificate filename parsing High 8.4
• CVE-2026-23995 EVerest has stack buffer overflow in ifreq.ifr_name when interface name exceeds IFNAMSIZ High 8.4
• CVE-2025-68137 EVerest's Integer Overflow and Signed to Unsigned conversion lead to either stack buffer overflow or infinite loop High 8.4
• CVE-2026-33009 EVerest: MQTT Switch-Phases Command Data Race Causing Charger State Corruptio High 8.2

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-xww8-4hfx-9fjw.