CVE-2026-29044
EVerest is an EV charging software stack.
Published Mar 26, 2026 · updated Jun 17, 2026 · linuxfoundation everest
EVerest is an EV charging software stack. Prior to version 2026.02.0, when WithdrawAuthorization is processed before the TransactionStarted event, AuthHandler determines and only calls . This path ultimately calls , but no actual stop (StopTransaction) occurs in the Charging state. As a result, authorization withdrawal can be defeated by timing, allowing charging to continue. Version 2026.02.0 contains a patch.
Code
The project this record applies to. Exploit listings stay in References.
No public source repository is identified for this product.
Timeline
Detection, updates, and resolution for this record.
Mar 26, 2026 · NIST NVD
Detected
EVerest is an EV charging software stack. Prior to version 2026.02.0, when WithdrawAuthorization is processed before the TransactionStarted event, AuthHandler determines and only calls . This path ultimately calls , but no actual stop (StopTransaction) occurs in the Charging state. As a result, authorization withdrawal can be defeated by timing, allowing charging to continue. Version 2026.02.0 con
Jun 17, 2026 · NIST NVD
Updated
EVerest is an EV charging software stack. Prior to version 2026.02.0, when WithdrawAuthorization is processed before the TransactionStarted event, AuthHandler determines and only calls . This path ultimately calls , but no actual stop (StopTransaction) occurs in the Charging state. As a result, authorization withdrawal can be defeated by timing, allowing charging to continue. Version 2026.02.0 con
Affected
- cpe linuxfoundation/everestversion unspecified
Sources
- CVE.orgVulnerability recordCVE-2026-29044
Official CVE identifier
cve.org - NIST NVDVulnerability recordCVE-2026-29044
EVerest is an EV charging software stack. Prior to version 2026.02.0, when WithdrawAuthorization is processed before the TransactionStarted event, AuthHandler determines and only calls . This path ultimately calls `Charg
nvd.nist.gov