CVE-2024-24746 Apache NimBLE: Denial of service in NimBLE Bluetooth stack

2024-04-0611:56:07

CWE-835

apache

www.cve.org

cve-2024-24746

apache nimble

unreachable exit condition

gatt operation

bluetooth stack

device upgrade

6.7 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

15.5%

JSON

Loop with Unreachable Exit Condition (‘Infinite Loop’) vulnerability in Apache NimBLE.

Specially crafted GATT operation can cause infinite loop in GATT server leading to denial of service in Bluetooth stack or device.

This issue affects Apache NimBLE: through 1.6.0.
Users are recommended to upgrade to version 1.7.0, which fixes the issue.

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "Apache NimBLE",
    "vendor": "Apache Software Foundation",
    "versions": [
      {
        "lessThanOrEqual": "1.6.0",
        "status": "affected",
        "version": "0",
        "versionType": "custom"
      }
    ]
  }
]