Apache Mynewt NimBLE vulnerabilities

3 known vulnerabilities in Apache Mynewt NimBLE from Apache. 3 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 8.1 High severity

  Apache Mynewt NimBLE: Authentication Bypass by Spoofing

  CVE-2025-62235Jan 10, 2026Apache

  Authentication Bypass by Spoofing vulnerability in Apache NimBLE. Receiving specially crafted Security Request could lead to removal of original bond and re-bond with impostor. This issue affects Apache NimBLE: through 1.8.0. Users are recommended to upgrade t

• 7.5 High severity

  Apache Mynewt NimBLE: NULL Pointer Dereference

  CVE-2025-53477Jan 10, 2026Apache

  NULL Pointer Dereference vulnerability in Apache Nimble. Missing validation of HCI connection complete or HCI command TX buffer could lead to NULL pointer dereference. This issue requires disabled asserts and broken or bogus Bluetooth controller and thus sever

• 7.5 High severity

  Apache Mynewt NimBLE: J2EE Misconfiguration: Data Transmission Without Encryption

  CVE-2025-52435Jan 10, 2026Apache

  J2EE Misconfiguration: Data Transmission Without Encryption vulnerability in Apache NimBLE. Improper handling of Pause Encryption procedure on Link Layer results in a previously encrypted connection being left in un-encrypted state allowing an eavesdropper to