Nimble vulnerabilities

9 known vulnerabilities in Nimble from Apache. 9 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.5 High severity

  Apache NimBLE: NULL Pointer Dereference

  CVE-2026-45816Jul 24, 2026ApacheEPSS 1.03%

  NULL Pointer Dereference vulnerability in Apache NimBLE in LE Long Term Key Request event. This requires disabled asserts (otherwise assert would trigger before NULL dereference) and bogus (or misbehaving) controller, thus severity is low. This issue affects A

• 7.5 High severity

  Apache NimBLE: Reachable Assertion

  CVE-2026-45815Jul 24, 2026ApacheEPSS 1.03%

  Reachable Assertion vulnerability in Apache NimBLE. A specially crafted ATT Read Multiple Variable Response (BLE_ATT_OP_READ_MULT_VAR_RSP) may trigger assert in ATT parser. Severity is medium as this requires DUT to first send ATT Read Multiple Variable Reques

• 8.8 High severity

  Apache NimBLE: Integer Underflow (Wrap or Wraparound)

  CVE-2026-45813Jul 24, 2026Apache

  Out-of-bounds Write, Integer Underflow (Wrap or Wraparound) vulnerability in Apache NimBLE BASS service. Improper validation when parsing BASS service "Add Source" and "Modify Source" operation PDU could results in stack buffer overflow or arbitrary out-of-bou

• 7.5 High severity

  Apache NimBLE: Buffer Copy without Checking Size of Input

  CVE-2026-45811Jul 24, 2026Apache

  Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in Apache NimBLE. The HCI socket transport did not check whether a received HCI event would fit the configured event pool before copying it, allowing a buffer overflow. Severi

• 8.1 High severity

  Apache Mynewt NimBLE: Authentication Bypass by Spoofing

  CVE-2025-62235Jan 10, 2026Apache

  Authentication Bypass by Spoofing vulnerability in Apache NimBLE. Receiving specially crafted Security Request could lead to removal of original bond and re-bond with impostor. This issue affects Apache NimBLE: through 1.8.0. Users are recommended to upgrade t

• 7.5 High severity

  Apache Mynewt NimBLE: NULL Pointer Dereference

  CVE-2025-53477Jan 10, 2026Apache

  NULL Pointer Dereference vulnerability in Apache Nimble. Missing validation of HCI connection complete or HCI command TX buffer could lead to NULL pointer dereference. This issue requires disabled asserts and broken or bogus Bluetooth controller and thus sever

• 7.5 High severity

  Apache Mynewt NimBLE: J2EE Misconfiguration: Data Transmission Without Encryption

  CVE-2025-52435Jan 10, 2026Apache

  J2EE Misconfiguration: Data Transmission Without Encryption vulnerability in Apache NimBLE. Improper handling of Pause Encryption procedure on Link Layer results in a previously encrypted connection being left in un-encrypted state allowing an eavesdropper to

• 7.5 High severity

  Apache NimBLE: Out-of-bounds Read

  CVE-2024-51569Nov 26, 2024ApacheEPSS 1.24%

  Out-of-bounds Read vulnerability in Apache NimBLE. Missing proper validation of HCI Number Of Completed Packets could lead to out-of-bound access when parsing HCI event and invalid read from HCI transport memory. This issue requires broken or bogus Bluetooth c

• 7.5 High severity

  Apache NimBLE: Loop with Unreachable Exit Condition

  CVE-2024-24746Apr 6, 2024ApacheEPSS 1.45%

  Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in Apache NimBLE. Specially crafted GATT operation can cause infinite loop in GATT server leading to denial of service in Bluetooth stack or device. This issue affects Apache NimBLE: through