CVE-2026-23955

EVerest vulnerable to concatenation of strings literal and integers

State: Published
Severity: 4.2 Medium
Published: Jan 21, 2026
Updated: Jan 21, 2026
Reserved: Jan 19, 2026

Description

EVerest is an EV charging software stack. Prior to version 2025.9.0, in several places, integer values are concatenated to literal strings when throwing errors. This results in pointers arithmetic instead of printing the integer value as expected, like most of interpreted languages. This can be used by malicious operator to read unintended memory regions, including the heap and the stack. Version 2025.9.0 fixes the issue.

Scores

CVSS	Score	Vector	Source
3.1	4.2 Medium	CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N	GitHub_M

Weaknesses

CWE-1046 Creation of Immutable Text Using String Concatenation

Affected Products

Product	Versions
everest-coreEVerest	< 2025.9.0Affected

References

https://github.com/EVerest/everest-core/security/advisories/GHSA-px57-jx97-hrff

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.