CVE-2026-29044

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-29044
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-29044.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-29044
Aliases
  • GHSA-gx37-p775-qf5v
Published
2026-03-26T16:37:33.230Z
Modified
2026-04-10T05:41:26.958930Z
Severity
  • 5.0 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:H/A:L CVSS Calculator
Summary
EVerest: Charging Continues When WithdrawAuthorization Is Processed Before TransactionStarted
Details

EVerest is an EV charging software stack. Prior to version 2026.02.0, when WithdrawAuthorization is processed before the TransactionStarted event, AuthHandler determines transaction_active=false and only calls withdraw_authorization_callback. This path ultimately calls Charger::deauthorize(), but no actual stop (StopTransaction) occurs in the Charging state. As a result, authorization withdrawal can be defeated by timing, allowing charging to continue. Version 2026.02.0 contains a patch.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-863"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/29xxx/CVE-2026-29044.json"
}
References

Affected packages

Git / github.com/everest/everest

Affected ranges

Type
GIT
Repo
https://github.com/everest/everest
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
b666184ef94a70008388cdec7ec41c14549e9bad
Database specific 
{
    "versions": [
        {
            "introduced": "0"
        },
        {
            "fixed": "2026.02.0"
        }
    ]
}

Affected versions

2022.*
2022.12.0
2022.12.1
2023.*
2023.1.0
2023.10.0
2023.12.0
2023.2.0
2023.2.1
2023.3.0
2023.5.0
2023.6.0
2023.7.0
2023.8.0
2023.9.0
2023.9.1
2024.*
2024.1.0
2024.10.0
2024.11.0
2024.2.0
2024.3.0-rc1
2024.4.0
2024.5.0
2024.6.0-rc1
2024.6.0-rc2
2024.7.0
2024.7.1
2024.8.0
2024.9.0-rc1
2025.*
2025.1.0-rc1
2025.1.0-rc2
2025.10.0
2025.12.0
2025.12.1
2025.2.0
2025.3.0
2025.4.0-rc1
2025.5.0
2025.6.0
2025.7.0
2025.7.0-rc1
2025.8.0
2025.9.0
2026.*
2026.02.0-rc1
2026.02.0-rc2
2026.02.0-rc3
2026.02.0-rc4

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-29044.json"