bitchat

bitchat A decentralized peer-to-peer messaging app with dual transport architecture: local Bluetooth mesh networks for offline communication and internet-based Nostr protocol for global reach. No accounts, no phone numbers, no central servers. It's the side-groupchat. bitchat.free 📲 App Store...

bitchat-android

!WARNING This software has not received external security review and may contain vulnerabilities and may not necessarily meet its stated security goals. Do not use it for sensitive use cases, and do not rely on its security until it has been reviewed. Work in progress. bitchat for Android A secur...

CVE-2026-19936

The Bluetooth Mesh Access-layer delayable message queue in subsys/bluetooth/mesh/delayablemsg.c shares three intrusive lists busyctx, freectx, freechunks and one kworkdelayable between two cooperative threads with no synchronization: btmeshdelayablemsgmanage runs on the Bluetooth host RX thread,...

CVE-2026-19937

The Bluetooth Mesh Access layer delayable-message machinery in subsys/bluetooth/mesh/delayablemsg.c manages a static pool of CONFIGBTMESHACCESSDELAYABLEMSGCOUNT message contexts default 4 threaded onto a freectx or busyctx list. releasedelayablemsgctx returned a context to freectx only when...

CVE-2026-19937 Bluetooth Mesh Access layer permanently leaks delayable-message contexts, disabling all model responses

The Bluetooth Mesh Access layer delayable-message machinery in subsys/bluetooth/mesh/delayablemsg.c manages a static pool of CONFIGBTMESHACCESSDELAYABLEMSGCOUNT message contexts default 4 threaded onto a freectx or busyctx list. releasedelayablemsgctx returned a context to freectx only when...

CVE-2026-19937

The Bluetooth Mesh Access layer in Zephyr RTOS (specifically subsys/bluetooth/mesh/delayable_msg.c) contains a resource leak vulnerability. The bt_mesh_delayable_msg_manage() function fails to correctly re-insert a message context into the pool during a chunk-exhaustion error path, causing the co...

CVE-2026-19937 Bluetooth Mesh Access layer permanently leaks delayable-message contexts, disabling all model responses

The Bluetooth Mesh Access layer delayable-message machinery in subsys/bluetooth/mesh/delayablemsg.c manages a static pool of CONFIGBTMESHACCESSDELAYABLEMSGCOUNT message contexts default 4 threaded onto a freectx or busyctx list. releasedelayablemsgctx returned a context to freectx only when...

CVE-2026-19936

The Bluetooth Mesh Access-layer delayable message queue in subsys/bluetooth/mesh/delayable_msg.c is vulnerable to a NULL pointer dereference due to unsynchronized access to shared intrusive lists (busy_ctx, free_ctx, free_chunks). Specifically, bt_mesh_delayable_msg_manage() (running on the Bluet...

CVE-2026-19936 Bluetooth Mesh delayable message queue: unsynchronized list access leads to NULL pointer dereference

The Bluetooth Mesh Access-layer delayable message queue in subsys/bluetooth/mesh/delayablemsg.c shares three intrusive lists busyctx, freectx, freechunks and one kworkdelayable between two cooperative threads with no synchronization: btmeshdelayablemsgmanage runs on the Bluetooth host RX thread,...

EUVD-2026-98093

The Bluetooth Mesh Access-layer delayable message queue in subsys/bluetooth/mesh/delayablemsg.c shares three intrusive lists busyctx, freectx, freechunks and one kworkdelayable between two cooperative threads with no synchronization: btmeshdelayablemsgmanage runs on the Bluetooth host RX thread,...

CVE-2026-15894

The Bluetooth Mesh On-Demand Private Proxy solicitation handler in subsys/bluetooth/mesh/solicitation.c copies a received Solicitation PDU into a fixed 17-byte stack buffer without bounding the source length. In solpdudecrypt, out is allocated as NETBUFSIMPLE17 and then filled with...

CVE-2026-15894 Bluetooth Mesh solicitation PDU stack buffer overflow via oversized advertisement

The Bluetooth Mesh On-Demand Private Proxy solicitation handler in subsys/bluetooth/mesh/solicitation.c copies a received Solicitation PDU into a fixed 17-byte stack buffer without bounding the source length. In solpdudecrypt, out is allocated as NETBUFSIMPLE17 and then filled with...

CVE-2026-15894 Bluetooth Mesh solicitation PDU stack buffer overflow via oversized advertisement

The Bluetooth Mesh On-Demand Private Proxy solicitation handler in subsys/bluetooth/mesh/solicitation.c copies a received Solicitation PDU into a fixed 17-byte stack buffer without bounding the source length. In solpdudecrypt, out is allocated as NETBUFSIMPLE17 and then filled with...

CVE-2026-15894

The Zephyr RTOS Bluetooth Mesh stack is vulnerable to a stack-based buffer overflow in the On-Demand Private Proxy solicitation handler (subsys/bluetooth/mesh/solicitation.c). The sol_pdu_decrypt() function copies a received Solicitation PDU into a fixed 17-byte stack buffer without bounding the ...

EUVD-2026-94230

The Bluetooth Mesh On-Demand Private Proxy solicitation handler in subsys/bluetooth/mesh/solicitation.c copies a received Solicitation PDU into a fixed 17-byte stack buffer without bounding the source length. In solpdudecrypt, out is allocated as NETBUFSIMPLE17 and then filled with...

CVE-2026-15894 Bluetooth Mesh solicitation PDU stack buffer overflow via oversized advertisement

The Bluetooth Mesh On-Demand Private Proxy solicitation handler in subsys/bluetooth/mesh/solicitation.c copies a received Solicitation PDU into a fixed 17-byte stack buffer without bounding the source length. In solpdudecrypt, out is allocated as NETBUFSIMPLE17 and then filled with...

CVE-2026-15894: Stack-based Buffer Overflow

The Bluetooth Mesh On-Demand Private Proxy solicitation handler in subsys/bluetooth/mesh/solicitation.c copies a received Solicitation PDU into a fixed 17-byte stack buffer without bounding the source length. In solpdudecrypt, out is allocated as NETBUFSIMPLE17 and then filled with...

PT-2026-107438

The Bluetooth Mesh On-Demand Private Proxy solicitation handler in subsys/bluetooth/mesh/solicitation.c copies a received Solicitation PDU into a fixed 17-byte stack buffer without bounding the source length. In sol pdu decrypt, out is allocated as NET BUF SIMPLE17 and then filled with net buf...

EUVD-2026-67297

In Bluetooth Mesh SDK 6.1.4 and earlier, malformed extended advertisements can trigger out-of-bounds writes leading to stack corruption and remote code execution. These messages must come from a device that has already joined the network. Only provisioners supporting extended advertisements may b...

CVE-2026-5706

In Bluetooth Mesh SDK 6.1.4 and earlier, malformed extended advertisements can trigger out-of-bounds writes leading to stack corruption and remote code execution. These messages must come from a device that has already joined the network. Only provisioners supporting extended advertisements may b...