{"id":"CVE-2025-68138","summary":"EVerest affected by memory exhaustion in libocpp","details":"EVerest is an EV charging software stack, and EVerest libocpp is a C++ implementation of the Open Charge Point Protocol. In libocpp prior to version 0.30.1, pointers returned by the `strdup` calls are never freed. At each connection attempt, the newly allocated memory area will be leaked, potentially causing memory exhaustion and denial of service. Version 0.30.1 fixes the issue.","aliases":["GHSA-f8c2-44c3-7v55"],"modified":"2026-08-12T15:14:46.960860Z","published":"2026-01-21T19:30:49.196Z","database_specific":{"cwe_ids":["CWE-770"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/68xxx/CVE-2025-68138.json","cna_assigner":"GitHub_M"},"references":[{"type":"WEB","url":"https://github.com/EVerest/libocpp/blob/89c7b62ec899db637f43b54f19af2c4af30cfa66/lib/ocpp/common/websocket/websocket_libwebsockets.cpp"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/68xxx/CVE-2025-68138.json"},{"type":"ADVISORY","url":"https://github.com/EVerest/everest-core/security/advisories/GHSA-f8c2-44c3-7v55"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-68138"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/everest/libocpp","events":[{"introduced":"157ba65d9487c149dcd0ed31179a738c4b5ca343"},{"fixed":"157ba65d9487c149dcd0ed31179a738c4b5ca343"}],"database_specific":{"cpe":"cpe:2.3:a:linuxfoundation:libocpp:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"libocpp \u003c 0.30.1"},{"last_affected":"libocpp \u003c 0.30.1"},{"introduced":"0"},{"fixed":"0.30.1"}],"source":["AFFECTED_FIELD","CPE_RANGE"]}}],"versions":["libocpp \u003c 0.30.1"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-68138.json","vanir_signatures_modified":"2026-08-12T15:14:46Z","vanir_signatures":[{"id":"CVE-2025-68138-04551c11","signature_type":"Line","signature_version":"v1","source":"https://github.com/everest/libocpp/commit/157ba65d9487c149dcd0ed31179a738c4b5ca343","target":{"file":"lib/ocpp/v16/charge_point_impl.cpp"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["280415372501024428424000212732151750473","320402883727709006438697207218431066612","311578272350348683230613191031751270004","166658477097279531410134347126851606925"]}}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L"}]}