What is the CVSS score of CVE-2026-26071?

CVE-2026-26071 has a CVSS 3.1 base score of 4.2 (Medium). CVSS vector: CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.0%.

Which versions of Everest are affected by CVE-2026-26071?

Organizations using EVerest should be aware of moderate risk from CVE-2026-26071, a race condition vulnerability rated CVSS 4.2. Exploitation could compromise the security of affected deployments.. A patch is available.

How to fix or mitigate CVE-2026-26071?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

Everest CVE-2026-26071

EUVD-2026-16205 MEDIUM

Race Condition (CWE-362)

2026-03-26 security-advisories@github.com

Information Disclosure Race Condition Everest Linuxfoundation

4.2

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

4.2 MEDIUM

AV:P/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

Attack Vector

Physical

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Patch available

Apr 16, 2026 - 05:29 EUVD

2026.02.0

EUVD ID Assigned

Mar 26, 2026 - 15:22 euvd

EUVD-2026-16205

Analysis Generated

Mar 26, 2026 - 15:22 vuln.today

CVE Published

Mar 26, 2026 - 15:16 nvd

MEDIUM 4.2

DescriptionGitHub Advisory

EVerest is an EV charging software stack. Versions prior to 2026.02.0 have a data race leading to std::string concurrent access. with heap-use-after-free possible. This is triggered by EVCCID update (EV/ISO15118) and OCPP session/authorization events. Version 2026.02.0 contains a patch.

AnalysisAI

EVerest EV charging software versions before 2026.02.0 contain a race condition in std::string handling triggered by concurrent EVCCID updates and OCPP session events, potentially leading to heap-use-after-free and denial of service. Local attackers with physical access to the charging infrastructure can exploit this timing-dependent vulnerability to crash the charging service. A patch is available in version 2026.02.0 or later.

Technical ContextAI

EVerest is an open-source EV charging software stack that implements multiple concurrent protocols including ISO 15118 (EV-to-charger communication) and OCPP (Open Charge Point Protocol) for session management. The vulnerability exists in the core charger management logic where EVCCID (Electric Vehicle Communication Controller Identification) strings are updated by multiple concurrent event handlers without proper synchronization. The root cause is CWE-362 (Concurrent Execution using Shared Resource with Improper Synchronization), where unsynchronized access to std::string objects in C++ can lead to undefined behavior, memory corruption, and potential heap-use-after-free conditions when the string's internal buffer is reallocated or freed while another thread is accessing it. This is particularly dangerous in embedded charging infrastructure where protocol handlers operate asynchronously.

RemediationAI

Upgrade EVerest Core to version 2026.02.0 or later, which contains the synchronization fix for concurrent std::string access. The patched version is available from the EVerest project repository. Until patching is feasible, charging station operators should monitor system logs for unexpected terminations or crashes during high-concurrency charging sessions (multiple vehicles initiating authentication simultaneously) and consider implementing watchdog timers or automated restart mechanisms to minimize availability impact. For new deployments, use version 2026.02.0 or later exclusively. Network isolation of charging infrastructure from untrusted networks provides defense-in-depth but does not mitigate the underlying race condition. See the vendor advisory at https://github.com/EVerest/EVerest/security/advisories/GHSA-xww8-4hfx-9fjw for detailed patch notes and upgrade procedures.