CVE-2026-26008: Linuxfoundation Everest DoS Vulnerability

CVE-2026-26008 Overview

CVE-2026-26008 is an out-of-bounds access vulnerability in EVerest, the Linux Foundation's open-source electric vehicle (EV) charging software stack. The flaw resides in how EVerest processes UpdateAllowedEnergyTransferModes messages sent by a Charging Station Management System (CSMS) over the network. A malicious or compromised CSMS can trigger an out-of-bounds std::vector access, causing the charging station software to crash or experience memory corruption. The issue affects all versions prior to 2026.02.0 and is patched in version 2026.2.0. The vulnerability is tracked as [CWE-125] (Out-of-bounds Read).

Critical Impact
A network-reachable CSMS can crash EVerest charging stations or corrupt memory by sending crafted UpdateAllowedEnergyTransferModes messages, disrupting EV charging operations.

Affected Products

Linux Foundation EVerest versions prior to 2026.02.0
EVerest deployments accepting UpdateAllowedEnergyTransferModes messages from a CSMS
EV charging stations running affected EVerest builds

Discovery Timeline

2026-03-26 - CVE-2026-26008 published to NVD
2026-03-31 - Last updated in NVD database

Technical Details for CVE-2026-26008

Vulnerability Analysis

The vulnerability arises in EVerest's handling of the UpdateAllowedEnergyTransferModes message defined by the Open Charge Point Protocol (OCPP). When a CSMS transmits this message, EVerest parses the supplied list of energy transfer modes and writes or reads entries through a std::vector. The code does not validate the index or size before performing the access, producing an out-of-bounds memory operation.

Because std::vector::operator[] performs no bounds checking, the resulting access can read or corrupt adjacent heap memory. The most likely outcome is a process crash that terminates the charging session, but memory corruption may also cause undefined behavior in downstream components.

Exploitation requires network reachability to the EVerest charging station and the ability to deliver an UpdateAllowedEnergyTransferModes payload. No authentication or user interaction is required beyond the existing CSMS-to-charger trust relationship, which itself is the typical attack surface for charging infrastructure.

Root Cause

The root cause is missing input validation on container indices in the code path that processes UpdateAllowedEnergyTransferModes. The C++ implementation relies on std::vector element access without verifying that the requested index falls within the container's current size, producing classic [CWE-125] out-of-bounds behavior.

Attack Vector

The attack vector is network-based. A malicious actor controlling or impersonating a CSMS, or an attacker positioned between the CSMS and the charger, can deliver a crafted OCPP UpdateAllowedEnergyTransferModes message. The crafted message manipulates the energy transfer mode list to drive EVerest into an out-of-bounds access, resulting in denial of service against the charger.

The vulnerability mechanism is documented in the EVerest GitHub Security Advisory GHSA-vw95-6jj7-3fv9. No public proof-of-concept exploit is available at the time of publication.

Detection Methods for CVE-2026-26008

Indicators of Compromise

Unexpected EVerest process crashes or restarts coinciding with inbound OCPP traffic from a CSMS
OCPP UpdateAllowedEnergyTransferModes messages containing malformed or oversized energy transfer mode lists
Repeated charging session terminations affecting multiple chargers managed by the same CSMS

Detection Strategies

Inspect OCPP traffic for UpdateAllowedEnergyTransferModes messages and validate message structure against the OCPP schema before forwarding to EVerest
Monitor EVerest service logs and host telemetry for segmentation faults, abort signals, or abnormal exits in the OCPP handling component
Correlate CSMS message timestamps with charger availability metrics to identify message-driven outages

Monitoring Recommendations

Enable verbose OCPP message logging on charging stations and forward logs to a central analytics platform for retention and correlation
Track the EVerest version inventory across the charger fleet and alert on any deployment running a version below 2026.02.0
Alert on anomalous CSMS behavior such as bursts of UpdateAllowedEnergyTransferModes messages or messages originating from unexpected network sources

How to Mitigate CVE-2026-26008

Immediate Actions Required

Upgrade EVerest to version 2026.2.0 or later on all charging stations
Restrict network access to EVerest OCPP endpoints so that only the authorized CSMS can connect
Validate the trust chain between chargers and the CSMS, including TLS certificates and client authentication

Patch Information

The maintainers released version 2026.2.0 with a fix for the out-of-bounds access. Operators should follow the upgrade instructions in the EVerest GitHub Security Advisory GHSA-vw95-6jj7-3fv9 and verify the running version after deployment.

Workarounds

Place an OCPP-aware proxy or gateway in front of EVerest to filter or reject malformed UpdateAllowedEnergyTransferModes messages until patching completes
Segment charging stations onto a dedicated network reachable only by the authorized CSMS, blocking all other inbound traffic
Enable mutual TLS authentication between the CSMS and chargers to reduce the risk of a rogue or impersonated CSMS delivering crafted messages

bash

# Verify the installed EVerest version and upgrade if below 2026.02.0
everest --version
# Example upgrade workflow (adjust to your deployment tooling)
git fetch --tags
git checkout 2026.2.0
./build.sh && ./install.sh
systemctl restart everest