CVE-2024-24746

Apache NimBLE, an open-source Bluetooth 5.4 stack used in the Apache Mynewt project, is vulnerable to a Loop with Unreachable Exit Condition (CWE-835) in versions through 1.6.0 . A specially crafted GATT operation can trigger an infinite loop in the GATT server, resulting in a denial of service (...

CVE-2024-51569

Apache NimBLE (versions through 1.7.0 ) is vulnerable to an Out-of-bounds Read vulnerability due to a lack of proper input sanitization and validation of the HCI Number Of Completed Packets . This flaw can occur when parsing HCI events, potentially allowing an attacker to read invalid data from H...

CVE-2024-47248

The Apache NimBLE Bluetooth 5.4 stack (host and controller) is vulnerable to a Classic Buffer Overflow (CWE-120) in versions through 1.7.0 . The root cause is a buffer copy operation that fails to check the input size, which can be triggered by a specially crafted MESH message when a non-default ...

CVE-2024-47249

Apache NimBLE versions through 1.7.0 are vulnerable to an improper validation of array index (CWE-129) in the Bluetooth stack. The root cause is a lack of input validation for HCI events received from the controller, which can lead to out-of-bound memory corruption and system crashes. This vulner...

CVE-2024-47250

An Out-of-bounds Read vulnerability exists in Apache NimBLE (versions through 1.7.0 ). The root cause is a lack of proper validation of the HCI advertising report , which can lead to out-of-bounds access during HCI event parsing. This could result in the transmission of bogus GAP 'device found' e...

CVE-2025-62235

A security vulnerability exists in Apache NimBLE (an open-source Bluetooth 5.4 stack) versions through 1.8.0 . The flaw involves incorrect handling of SMP Security Requests , which allows an Authentication Bypass by Spoofing . By sending a specially crafted Security Request, an attacker can cause...

CVE-2025-53470

Apache NimBLE (versions through 1.8 ) contains an out-of-bounds read vulnerability in the HCI H4 driver . A specially crafted HCI event can trigger an invalid memory read within this driver. The impact is considered low because the vulnerability requires a broken or bogus Bluetooth controller to ...

CVE-2026-45815

Apache NimBLE versions through 1.9.0 are vulnerable to a reachable assertion in the ATT parser . An attacker can trigger an assertion by sending a specially crafted ATT Read Multiple Variable Response (BLE_ATT_OP_READ_MULT_VAR_RSP), provided the Device Under Test (DUT) has first initiated an ATT ...

CVE-2026-45811

Apache NimBLE versions through 1.9.0 are vulnerable to a Classic Buffer Overflow in the HCI socket transport . The root cause is a failure to verify if a received HCI event fits within the configured event pool before copying it. Exploitation is difficult as it requires either a misconfigured poo...

CVE-2026-46452

An Improper Input Validation vulnerability exists in Apache NimBLE (versions through 1.9.0) within the Mesh Proxy SAR reassembly process. The root cause involves an unbounded append and unchecked failure, which can lead to the transmission of broken data to the application. This flaw may result i...

CVE-2026-45813

Apache NimBLE versions through 1.9.0 are vulnerable to an out-of-bounds write and integer underflow (wrap or wraparound) in the BASS service. The root cause is improper validation during the parsing of Protocol Data Units (PDU) for "Add Source" and "Modify Source" operations. This flaw can result...

CVE-2025-52435

Apache NimBLE (versions

CVE-2026-45816

Apache NimBLE is vulnerable to a NULL Pointer Dereference during the LE Long Term Key Request event. This flaw occurs specifically when asserts are disabled and the system interacts with a misbehaving or bogus controller . The vulnerability affects versions through 1.9.0 . To mitigate this issue,...

CVE-2025-53477

A NULL Pointer Dereference vulnerability exists in Apache NimBLE (versions through 1.8.0) within the NimBLE host HCI layer . The flaw is caused by a lack of validation of the HCI connection complete or HCI command TX buffers. Exploitation requires disabled asserts and a broken or bogus Bluetooth ...

CVE-2026-45812

The Apache NimBLE Bluetooth stack (versions through 1.9.0 ) is vulnerable to an incorrect calculation of buffer size when processing Legacy Advertising Report HCI events . When a third-party controller bundles multiple reports into a single event, NimBLE miscalculates the offset, causing the host...