Nimble (Apache) - vulnerabilities (CVEs)

15 CVEs, 0 in the last 30 days, 26 known versions, newest CVE from 2026-07-24. Vendor: Apache.

CVEs of Nimble

CVE-2026-46452 - CVSS 5.3 (medium), 2026-07-24: Improper Input Validation vulnerability in Apache NimBLE in Mesh Proxy SAR reassembly could result in passing broken data toward application resulting in…
CVE-2026-45816 - CVSS 7.5 (high), 2026-07-24: NULL Pointer Dereference vulnerability in Apache NimBLE in LE Long Term Key Request event. This requires disabled asserts (otherwise assert would trigger…
CVE-2026-45815 - CVSS 7.5 (high), 2026-07-24: Reachable Assertion vulnerability in Apache NimBLE. A specially crafted ATT Read Multiple Variable Response (BLE_ATT_OP_READ_MULT_VAR_RSP) may trigger assert…
CVE-2026-45813 - CVSS 8.8 (high), 2026-07-24: Out-of-bounds Write, Integer Underflow (Wrap or Wraparound) vulnerability in Apache NimBLE BASS service. Improper validation when parsing BASS service "Add…
CVE-2026-45812 - CVSS 6.5 (medium), 2026-07-24: Incorrect Calculation of Buffer Size vulnerability in Apache NimBLE when processing Legacy Advertising Report HCI event. When a single HCI advertising report…
CVE-2026-45811 - CVSS 7.5 (high), 2026-07-24: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in Apache NimBLE. The HCI socket transport did not check whether a…
CVE-2025-52435 - CVSS 7.5 (high), 2026-01-10: J2EE Misconfiguration: Data Transmission Without Encryption vulnerability in Apache NimBLE. Improper handling of Pause Encryption procedure on Link Layer…
CVE-2025-62235 - CVSS 8.1 (high), 2026-01-10: Authentication Bypass by Spoofing vulnerability in Apache NimBLE. Receiving specially crafted Security Request could lead to removal of original bond and…
CVE-2025-53477 - CVSS 7.5 (high), 2026-01-10: NULL Pointer Dereference vulnerability in Apache Nimble. Missing validation of HCI connection complete or HCI command TX buffer could lead to NULL pointer…
CVE-2025-53470 - CVSS 3.1 (low), 2026-01-10: Out-of-bounds Read vulnerability in Apache NimBLE HCI H4 driver. Specially crafted HCI event could lead to invalid memory read in H4 driver. This issue…
CVE-2024-51569 - CVSS 7.5 (high), 2024-11-26: Out-of-bounds Read vulnerability in Apache NimBLE. Missing proper validation of HCI Number Of Completed Packets could lead to out-of-bound access when parsing…
CVE-2024-47248 - CVSS 6.3 (medium), 2024-11-26: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in Apache NimBLE. Specially crafted MESH message could result in memory…
CVE-2024-47250 - CVSS 5 (medium), 2024-11-26: Out-of-bounds Read vulnerability in Apache NimBLE. Missing proper validation of HCI advertising report could lead to out-of-bound access when parsing HCI…
CVE-2024-47249 - CVSS 5 (medium), 2024-11-26: Improper Validation of Array Index vulnerability in Apache NimBLE. Lack of input validation for HCI events from controller could result in out-of-bound memory…
CVE-2024-24746 - CVSS 7.5 (high), 2024-04-06: Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in Apache NimBLE. Specially crafted GATT operation can cause infinite loop in GATT…