CVE-2026-44383: OCPP Backend DOS Vulnerability

CVE-2026-44383 Overview

CVE-2026-44383 is a session management flaw affecting an Open Charge Point Protocol (OCPP) backend used in electric vehicle charging infrastructure. The backend permits multiple simultaneous connections that share the same charging station identifier. An attacker can abuse this behavior by spawning multiple malicious OCPP clients that reuse a valid station ID to exhaust backend resources. The issue is tracked under CWE-613: Insufficient Session Expiration and is documented in CISA ICS Advisory ICSA-26-188-01.

Critical Impact
Remote, unauthenticated attackers can overwhelm the OCPP backend by opening concurrent duplicate-ID sessions, degrading availability for legitimate charging stations.

Affected Products

OCPP backend implementation referenced in CISA ICSA-26-188-01
Electric vehicle supply equipment (EVSE) management systems relying on the affected backend
Deployments in the Energy sector using the affected charging station management platform

Discovery Timeline

2026-07-10 - CVE-2026-44383 published to the National Vulnerability Database
2026-07-13 - Last updated in NVD database

Technical Details for CVE-2026-44383

Vulnerability Analysis

The Open Charge Point Protocol (OCPP) defines how charging stations communicate with a central management system over WebSocket connections. Each charging station authenticates and registers using a unique charging station identifier. The affected backend fails to enforce a single active session per identifier. An attacker can therefore open many concurrent WebSocket sessions asserting the same station ID.

Because each new connection consumes memory, thread pool slots, and database handles, the backend eventually exhausts capacity. The result is a denial-of-service condition impacting availability for genuine charging stations attempting to report telemetry or accept transactions.

Root Cause

The root cause is insufficient session expiration and duplicate-session handling in the OCPP endpoint, classified as CWE-613. The backend accepts and retains new sessions without terminating or rejecting prior sessions bound to the same charging station identifier.

Attack Vector

Exploitation is remote and requires no authentication or user interaction, per the CVSS 4.0 vector recorded in the NVD entry. An attacker with network reachability to the OCPP endpoint and knowledge or guess of a valid charging station ID can script repeated WebSocket handshakes. The vulnerability affects availability only; confidentiality and integrity are not impacted. Refer to the CISA advisory and the CSAF JSON resource for protocol-level technical details.

Detection Methods for CVE-2026-44383

Indicators of Compromise

Multiple concurrent WebSocket sessions on the OCPP endpoint reporting the same chargePointId from different source IP addresses.
Rapid connection churn or connection floods targeting the OCPP /ocpp or vendor-specific WebSocket path.
Backend resource saturation events such as thread pool exhaustion, connection queue overflow, or elevated memory consumption on OCPP gateway processes.

Detection Strategies

Enable per-station session accounting in the OCPP backend and alert on more than one active session for the same identifier.
Correlate WebSocket upgrade requests at the reverse proxy or load balancer by client IP and station ID to surface duplicates.
Baseline normal charging station connection cadence and alert on deviations that resemble scripted client behavior.

Monitoring Recommendations

Forward OCPP gateway, reverse proxy, and network flow logs to a central analytics platform for correlation.
Track availability metrics such as backend CPU, memory, active WebSocket count, and message processing latency.
Monitor CISA ICS advisories and the referenced CSAF resource for updated remediation guidance.

How to Mitigate CVE-2026-44383

Immediate Actions Required

Restrict inbound access to the OCPP backend to known charging station networks using network segmentation and firewall allowlists.
Deploy rate limiting on the WebSocket endpoint at the reverse proxy layer to cap concurrent connections per source IP and per station ID.
Enable mutual TLS (mTLS) or strong OCPP security profiles so attackers cannot trivially assert an arbitrary chargePointId.

Patch Information

No vendor patch is listed in the NVD record at time of publication. Consult the CISA ICS Advisory ICSA-26-188-01 and coordinate directly with the operator, referenced in the advisory via Hydro-Québec contact information, for remediation status and fixed versions.

Workarounds

Configure the OCPP backend to terminate any existing session when a new session registers with the same charging station identifier.
Enforce a strict maximum connection count per identifier at the WebSocket gateway.
Place the OCPP endpoint behind a VPN or private network so it is not reachable from the public internet.

bash

# Example nginx rate limit for an OCPP WebSocket endpoint
limit_conn_zone $binary_remote_addr zone=ocpp_conn:10m;
server {
    listen 443 ssl;
    location /ocpp/ {
        limit_conn ocpp_conn 2;
        proxy_pass http://ocpp_backend;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
    }
}