An audit of everest-core, the open-source charging framework under the Linux Foundation Energy umbrella, turned up 11 concurrency flaws with public CVE IDs. The findings were presented at VehicleSec ’26 in Baltimore by Jaeyeong Lee and Seonhyeong Lee.
The problems cluster around how the software manages shared state. Eight of the bugs were reproduced as data races with the TSan, ASan, and UBSan sanitizers, and the other three were confirmed through logic-based proof-of-concept exploits that violate state integrity.
The impact reaches into the parts of a charging station that handle money and power. A session can keep drawing current after an operator sends a remote stop, an authorization withdrawal can be sidestepped, and memory corruption can knock the station offline entirely.
The authors point to three recurring causes in the code: locking discipline that is not applied consistently, state transitions that lack atomicity, and asynchronous events that arrive without validation. everest-core runs on top of hardware control, communication protocols, and cloud management all at once, so a single callback misstep ripples through the stack.
Because the framework is shared infrastructure, the researchers say the CVEs deserve fast attention from charge point operators and vendors. A patch applied upstream protects the whole ecosystem, and an unpatched deployment leaves the same exposed code paths in payment and authorization flows.
