CVE-2024-24746

CVE-2024-24746: Apache NimBLE's GATT server is vulnerable to a Denial of Service via a specially crafted GATT operation that causes an infinite loop. Affected software: NimBLE up to version 1.6.0; impact is denial of service to the Bluetooth stack/device. Remediation: upgrade to NimBLE 1.7.0 (fix).

CVE-2024-51569

CVE-2024-51569 affects Apache NimBLE (through 1.7.0). The root cause is missing validation of HCI Number Of Completed Packets, leading to an out-of-bounds read while parsing HCI events and reading from HCI transport memory. The issue requires a broken/bogus Bluetooth controller to trigger the fau...

CVE-2024-47248

Apache NimBLE

CVE-2024-47249

CVE-2024-47249 affects Apache NimBLE up to version 1.7.0. The issue is improper validation of array indices for HCI events from the Bluetooth controller, which can cause out-of-bounds memory corruption and crashes. Upgrading to NimBLE 1.8.0 is recommended and fixes the issue. No exploitation deta...

CVE-2024-47250

CVE-2024-47250 affects Apache NimBLE (through 1.7.0). The issue is an out-of-bounds read caused by missing validation of the HCI advertising report, which can trigger out-of-bound access while parsing HCI events and may generate bogus GAP “device found” events. The vulnerability requires a broken...

CVE-2025-62235

CVE-2025-62235 : Authentication bypass by spoofing in Apache NimBLE allows an attacker to remove the original Bond and re-bind with an impostor via a specially crafted Security Request. Affected software: Apache NimBLE up to version 1.8.0; impact includes potential compromise of pairing/authentic...

CVE-2025-53470

Summary: CVE-2025-53470 affects Apache NimBLE’s HCI H4 driver. An out-of-bounds read can be triggered by a specially crafted HCI event, leading to an invalid memory read.affected software: Apache NimBLE up to version 1.8 (inclusive); advisory recommends upgrading to version 1.9 which contains the...

CVE-2025-52435

CVE-2025-52435 affects Apache NimBLE (Mynewt NimBLE) up to version 1.8.0. The issue is caused by improper handling of the Pause Encryption procedure on the Link Layer, which can leave a previously encrypted connection in an unencrypted state and allow an eavesdropper to observe the remainder of t...

CVE-2026-45815

CVE-2026-45815 describes a Reachable Assertion vulnerability in Apache NimBLE up to version 1.9.0. A specially crafted BLE ATT Read Multiple Variable Response (BLE_ATT_OP_READ_MULT_VAR_RSP) can trigger an assertion in the ATT parser. Exploitation requires the DUT to send an ATT Read Multiple Vari...

CVE-2026-45816

CVE-2026-45816 is a NULL pointer dereference vulnerability in Apache NimBLE during the LE Long Term Key (LTK) request event. The issue occurs through NimBLE versions up to 1.9.0 and relies on disabled asserts with a bogus/misbehaving controller, leading to a crash. Impact is described as availabi...

CVE-2025-53477

CVE-2025-53477 is a NULL pointer dereference vulnerability in Apache NimBLE (NimBLE host HCI layer). The issue stems from missing validation of HCI connection complete or HCI command TX buffers, which can lead to a NULL pointer dereference when combined with disabled asserts and a malfunctioning ...

CVE-2026-46452

CVE-2026-46452 covers an Improper Input Validation vulnerability in Apache NimBLE’s Mesh Proxy SAR reassembly path. The issue can cause broken data to be passed toward the application, leading to memory pressure and unstable parsing behavior. Affected software ranges to NimBLE up to version 1.9.0...

CVE-2026-45813

CVE-2026-45813 covers an out-of-bounds write and integer underflow in the Apache NimBLE BASS service. The issue arises from improper validation when parsing the BASS service “Add Source” and “Modify Source” PDUs, which can cause a stack buffer overflow or arbitrary out-of-bounds read. It is trigg...

CVE-2026-45811

CVE-2026-45811: Buffer Copy without Checking Size of Input in Apache NimBLE's HCI socket transport allows a buffer overflow because the received HCI event might not fit the configured event pool. Affects NimBLE up to version 1.9.0; upgrade to 1.10.0 to fix. Exploitation requires either a misconfi...

CVE-2026-45812

CVE-2026-45812 affects Apache NimBLE up to 1.9.0. When a single Legacy Advertising Report HCI event bundles multiple reports, NimBLE miscalculates the offset to the next report, which can cause the host to read past the end of the buffer and deliver a GAP event with bogus data to the application....