Search criteria

8 vulnerabilities found for Apache Mynewt NimBLE by Apache Software Foundation

CVE-2025-62235 (GCVE-0-2025-62235)

Vulnerability from nvd – Published: 2026-01-10 09:42 – Updated: 2026-01-10 10:07
VLAI?
Title
Apache Mynewt NimBLE: Incorrect handling of SMP Security Request could lead to undesirable pairing
Summary
Authentication Bypass by Spoofing vulnerability in Apache NimBLE. Receiving specially crafted Security Request could lead to removal of original bond and re-bond with impostor. This issue affects Apache NimBLE: through 1.8.0. Users are recommended to upgrade to version 1.9.0, which fixes the issue.
Severity ?
No CVSS data available.
CWE
  • CWE-290 - Authentication Bypass by Spoofing
Assigner
References
Impacted products
Vendor Product Version
Apache Software Foundation Apache Mynewt NimBLE Affected: 0 , ≤ 1.8.0 (semver)
Create a notification for this product.
Credits
Tommaso Sacchetti <tommaso.sacchetti@gmail.com>
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2026-01-10T10:07:12.051Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://www.openwall.com/lists/oss-security/2026/01/08/4"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Apache Mynewt NimBLE",
          "vendor": "Apache Software Foundation",
          "versions": [
            {
              "lessThanOrEqual": "1.8.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Tommaso Sacchetti \u003ctommaso.sacchetti@gmail.com\u003e"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eAuthentication Bypass by Spoofing vulnerability in Apache NimBLE.\u003c/p\u003eReceiving specially crafted Security Request could lead to removal of original bond\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003e\u0026nbsp;and re-bond with impostor.\u003c/span\u003e\u003cbr\u003e\u003cp\u003eThis issue affects Apache NimBLE: through 1.8.0.\u003c/p\u003e\u003cp\u003eUsers are recommended to upgrade to version 1.9.0, which fixes the issue.\u003c/p\u003e"
            }
          ],
          "value": "Authentication Bypass by Spoofing vulnerability in Apache NimBLE.\n\nReceiving specially crafted Security Request could lead to removal of original bond\u00a0and re-bond with impostor.\nThis issue affects Apache NimBLE: through 1.8.0.\n\nUsers are recommended to upgrade to version 1.9.0, which fixes the issue."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "text": "important"
            },
            "type": "Textual description of severity"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-290",
              "description": "CWE-290 Authentication Bypass by Spoofing",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-01-10T09:42:30.446Z",
        "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
        "shortName": "apache"
      },
      "references": [
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/apache/mynewt-nimble/commit/41f67e391e788c5feef9030026cc5cbc5431838a"
        },
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.apache.org/thread/rw2mrpfwb9d9wmq4h4b6ctcd6gpkk2ho"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Apache Mynewt NimBLE: Incorrect handling of SMP Security Request could lead to undesirable pairing",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
    "assignerShortName": "apache",
    "cveId": "CVE-2025-62235",
    "datePublished": "2026-01-10T09:42:30.446Z",
    "dateReserved": "2025-10-09T15:28:28.169Z",
    "dateUpdated": "2026-01-10T10:07:12.051Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-53477 (GCVE-0-2025-53477)

Vulnerability from nvd – Published: 2026-01-10 09:45 – Updated: 2026-01-10 10:06
VLAI?
Title
Apache Mynewt NimBLE: NULL Pointer Dereference in NimBLE host HCI layer
Summary
NULL Pointer Dereference vulnerability in Apache Nimble. Missing validation of HCI connection complete or HCI command TX buffer could lead to NULL pointer dereference. This issue requires disabled asserts and broken or bogus Bluetooth controller and thus severity is considered low. This issue affects Apache NimBLE: through 1.8.0. Users are recommended to upgrade to version 1.9.0, which fixes the issue.
Severity ?
No CVSS data available.
CWE
  • CWE-476 - NULL Pointer Dereference
Assigner
References
Impacted products
Vendor Product Version
Apache Software Foundation Apache Mynewt NimBLE Affected: 0 , ≤ 1.8.0 (custom)
Create a notification for this product.
Credits
雷重庆 <leicq@seu.edu.cn>
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2026-01-10T10:06:51.559Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://www.openwall.com/lists/oss-security/2026/01/08/3"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Apache Mynewt NimBLE",
          "vendor": "Apache Software Foundation",
          "versions": [
            {
              "lessThanOrEqual": "1.8.0",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "\u96f7\u91cd\u5e86 \u003cleicq@seu.edu.cn\u003e"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eNULL Pointer Dereference vulnerability in Apache Nimble.\u003c/p\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eMissing validation of HCI connection complete or HCI command TX buffer could lead to NULL pointer dereference.\u003c/span\u003e\u003cbr\u003eThis issue requires disabled asserts and broken or bogus Bluetooth controller and thus severity is considered low.\u003cbr\u003e\u003cbr\u003e\u003cp\u003eThis issue affects Apache NimBLE: through 1.8.0.\u003c/p\u003e\u003cp\u003eUsers are recommended to upgrade to version 1.9.0, which fixes the issue.\u003c/p\u003e"
            }
          ],
          "value": "NULL Pointer Dereference vulnerability in Apache Nimble.\n\nMissing validation of HCI connection complete or HCI command TX buffer could lead to NULL pointer dereference.\nThis issue requires disabled asserts and broken or bogus Bluetooth controller and thus severity is considered low.\n\nThis issue affects Apache NimBLE: through 1.8.0.\n\nUsers are recommended to upgrade to version 1.9.0, which fixes the issue."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "text": "low"
            },
            "type": "Textual description of severity"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-476",
              "description": "CWE-476 NULL Pointer Dereference",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-01-10T09:45:27.630Z",
        "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
        "shortName": "apache"
      },
      "references": [
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/apache/mynewt-nimble/commit/0caf9baeb271ede85fcc5237ab87ddbf938600da"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/apache/mynewt-nimble/commit/3160b8c4c7ff8db4e0f9badcdf7df684b151e077"
        },
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.apache.org/thread/1dxthc132hwm2tzvjblrtnschcsbw2vo"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Apache Mynewt NimBLE: NULL Pointer Dereference in NimBLE host HCI layer",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
    "assignerShortName": "apache",
    "cveId": "CVE-2025-53477",
    "datePublished": "2026-01-10T09:45:27.630Z",
    "dateReserved": "2025-06-30T14:54:12.319Z",
    "dateUpdated": "2026-01-10T10:06:51.559Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-53470 (GCVE-0-2025-53470)

Vulnerability from nvd – Published: 2026-01-10 09:46 – Updated: 2026-01-10 10:06
VLAI?
Title
Apache Mynewt NimBLE: Out-of-Bounds Write Vulnerability in NimBLE HCI H4 driver
Summary
Out-of-bounds Read vulnerability in Apache NimBLE HCI H4 driver. Specially crafted HCI event could lead to invalid memory read in H4 driver. This issue affects Apache NimBLE: through 1.8.  This issue requires a broken or bogus Bluetooth controller and thus severity is considered low. Users are recommended to upgrade to version 1.9, which fixes the issue.
Severity ?
No CVSS data available.
CWE
Assigner
References
Impacted products
Vendor Product Version
Apache Software Foundation Apache Mynewt NimBLE Affected: 0 , ≤ 1.8 (semver)
Create a notification for this product.
Credits
雷重庆 <leicq@seu.edu.cn>
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2026-01-10T10:06:49.945Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://www.openwall.com/lists/oss-security/2026/01/08/2"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Apache Mynewt NimBLE",
          "vendor": "Apache Software Foundation",
          "versions": [
            {
              "lessThanOrEqual": "1.8",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "\u96f7\u91cd\u5e86 \u003cleicq@seu.edu.cn\u003e"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eOut-of-bounds Read vulnerability in Apache  NimBLE HCI H4 driver. Specially crafted HCI event could lead to invalid memory read in H4 driver.\u003c/p\u003e\u003cp\u003eThis issue affects Apache NimBLE: through 1.8.\u0026nbsp;\u003c/p\u003e\u003cp\u003eThis issue requires a broken or bogus Bluetooth controller and thus severity is considered low.\u003c/p\u003e\u003cp\u003eUsers are recommended to upgrade to version 1.9, which fixes the issue.\u003c/p\u003e"
            }
          ],
          "value": "Out-of-bounds Read vulnerability in Apache  NimBLE HCI H4 driver. Specially crafted HCI event could lead to invalid memory read in H4 driver.\n\nThis issue affects Apache NimBLE: through 1.8.\u00a0\n\nThis issue requires a broken or bogus Bluetooth controller and thus severity is considered low.\n\nUsers are recommended to upgrade to version 1.9, which fixes the issue."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "text": "low"
            },
            "type": "Textual description of severity"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-125",
              "description": "CWE-125 Out-of-bounds Read",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-01-10T09:46:35.789Z",
        "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
        "shortName": "apache"
      },
      "references": [
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/apache/mynewt-nimble/commit/b973df0c6cf7b30efbf8eb2cafdc1ee843464b76"
        },
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.apache.org/thread/32sm0944dyod4sdql77stgyw9xb2msc0"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Apache Mynewt NimBLE: Out-of-Bounds Write Vulnerability in NimBLE HCI H4 driver",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
    "assignerShortName": "apache",
    "cveId": "CVE-2025-53470",
    "datePublished": "2026-01-10T09:46:35.789Z",
    "dateReserved": "2025-06-30T13:43:23.389Z",
    "dateUpdated": "2026-01-10T10:06:49.945Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-52435 (GCVE-0-2025-52435)

Vulnerability from nvd – Published: 2026-01-10 09:47 – Updated: 2026-01-10 10:06
VLAI?
Title
Apache Mynewt NimBLE: Invalid error handling in pause encryption procedure in NimBLE controller
Summary
J2EE Misconfiguration: Data Transmission Without Encryption vulnerability in Apache NimBLE. Improper handling of Pause Encryption procedure on Link Layer results in a previously encrypted connection being left in un-encrypted state allowing an eavesdropper to observe the remainder of the exchange. This issue affects Apache NimBLE: through <= 1.8.0. Users are recommended to upgrade to version 1.9.0, which fixes the issue.
Severity ?
No CVSS data available.
CWE
Assigner
References
Impacted products
Vendor Product Version
Apache Software Foundation Apache Mynewt NimBLE Affected: 0 , ≤ 1.8.0 (semver)
Create a notification for this product.
Credits
Henrik Schnor <henrik.schnor@mailbox.org>
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2026-01-10T10:06:48.238Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://www.openwall.com/lists/oss-security/2026/01/08/1"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Apache Mynewt NimBLE",
          "vendor": "Apache Software Foundation",
          "versions": [
            {
              "lessThanOrEqual": "1.8.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Henrik Schnor \u003chenrik.schnor@mailbox.org\u003e"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eJ2EE Misconfiguration: Data Transmission Without Encryption vulnerability in Apache NimBLE.\u003c/p\u003eImproper handling of Pause Encryption procedure on Link Layer results in a previously encrypted connection being left in un-encrypted state \u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eallowing an eavesdropper to observe the remainder of the exchange\u003c/span\u003e.\u003cbr\u003e\u003cp\u003eThis issue affects Apache NimBLE: through \u0026lt;= 1.8.0.\u003c/p\u003e\u003cp\u003eUsers are recommended to upgrade to version 1.9.0, which fixes the issue.\u003c/p\u003e"
            }
          ],
          "value": "J2EE Misconfiguration: Data Transmission Without Encryption vulnerability in Apache NimBLE.\n\nImproper handling of Pause Encryption procedure on Link Layer results in a previously encrypted connection being left in un-encrypted state allowing an eavesdropper to observe the remainder of the exchange.\nThis issue affects Apache NimBLE: through \u003c= 1.8.0.\n\nUsers are recommended to upgrade to version 1.9.0, which fixes the issue."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "text": "important"
            },
            "type": "Textual description of severity"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-5 J2EE Misconfiguration: Data Transmission Without Encryption",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-01-10T09:47:10.568Z",
        "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
        "shortName": "apache"
      },
      "references": [
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/apache/mynewt-nimble/commit/164f1c23c18a290908df76ed83fe848bfe4a4903"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/apache/mynewt-nimble/commit/ec3d75e909fa6dcadf1836fefc4432794a673d18"
        },
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.apache.org/thread/ow8dzpsqfh9llfclh5fzh6z237brzc0s"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Apache Mynewt NimBLE: Invalid error handling in pause encryption procedure in NimBLE controller",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
    "assignerShortName": "apache",
    "cveId": "CVE-2025-52435",
    "datePublished": "2026-01-10T09:47:10.568Z",
    "dateReserved": "2025-06-16T14:01:50.268Z",
    "dateUpdated": "2026-01-10T10:06:48.238Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-52435 (GCVE-0-2025-52435)

Vulnerability from cvelistv5 – Published: 2026-01-10 09:47 – Updated: 2026-01-10 10:06
VLAI?
Title
Apache Mynewt NimBLE: Invalid error handling in pause encryption procedure in NimBLE controller
Summary
J2EE Misconfiguration: Data Transmission Without Encryption vulnerability in Apache NimBLE. Improper handling of Pause Encryption procedure on Link Layer results in a previously encrypted connection being left in un-encrypted state allowing an eavesdropper to observe the remainder of the exchange. This issue affects Apache NimBLE: through <= 1.8.0. Users are recommended to upgrade to version 1.9.0, which fixes the issue.
Severity ?
No CVSS data available.
CWE
Assigner
References
Impacted products
Vendor Product Version
Apache Software Foundation Apache Mynewt NimBLE Affected: 0 , ≤ 1.8.0 (semver)
Create a notification for this product.
Credits
Henrik Schnor <henrik.schnor@mailbox.org>
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2026-01-10T10:06:48.238Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://www.openwall.com/lists/oss-security/2026/01/08/1"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Apache Mynewt NimBLE",
          "vendor": "Apache Software Foundation",
          "versions": [
            {
              "lessThanOrEqual": "1.8.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Henrik Schnor \u003chenrik.schnor@mailbox.org\u003e"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eJ2EE Misconfiguration: Data Transmission Without Encryption vulnerability in Apache NimBLE.\u003c/p\u003eImproper handling of Pause Encryption procedure on Link Layer results in a previously encrypted connection being left in un-encrypted state \u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eallowing an eavesdropper to observe the remainder of the exchange\u003c/span\u003e.\u003cbr\u003e\u003cp\u003eThis issue affects Apache NimBLE: through \u0026lt;= 1.8.0.\u003c/p\u003e\u003cp\u003eUsers are recommended to upgrade to version 1.9.0, which fixes the issue.\u003c/p\u003e"
            }
          ],
          "value": "J2EE Misconfiguration: Data Transmission Without Encryption vulnerability in Apache NimBLE.\n\nImproper handling of Pause Encryption procedure on Link Layer results in a previously encrypted connection being left in un-encrypted state allowing an eavesdropper to observe the remainder of the exchange.\nThis issue affects Apache NimBLE: through \u003c= 1.8.0.\n\nUsers are recommended to upgrade to version 1.9.0, which fixes the issue."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "text": "important"
            },
            "type": "Textual description of severity"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-5 J2EE Misconfiguration: Data Transmission Without Encryption",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-01-10T09:47:10.568Z",
        "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
        "shortName": "apache"
      },
      "references": [
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/apache/mynewt-nimble/commit/164f1c23c18a290908df76ed83fe848bfe4a4903"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/apache/mynewt-nimble/commit/ec3d75e909fa6dcadf1836fefc4432794a673d18"
        },
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.apache.org/thread/ow8dzpsqfh9llfclh5fzh6z237brzc0s"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Apache Mynewt NimBLE: Invalid error handling in pause encryption procedure in NimBLE controller",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
    "assignerShortName": "apache",
    "cveId": "CVE-2025-52435",
    "datePublished": "2026-01-10T09:47:10.568Z",
    "dateReserved": "2025-06-16T14:01:50.268Z",
    "dateUpdated": "2026-01-10T10:06:48.238Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-53470 (GCVE-0-2025-53470)

Vulnerability from cvelistv5 – Published: 2026-01-10 09:46 – Updated: 2026-01-10 10:06
VLAI?
Title
Apache Mynewt NimBLE: Out-of-Bounds Write Vulnerability in NimBLE HCI H4 driver
Summary
Out-of-bounds Read vulnerability in Apache NimBLE HCI H4 driver. Specially crafted HCI event could lead to invalid memory read in H4 driver. This issue affects Apache NimBLE: through 1.8.  This issue requires a broken or bogus Bluetooth controller and thus severity is considered low. Users are recommended to upgrade to version 1.9, which fixes the issue.
Severity ?
No CVSS data available.
CWE
Assigner
References
Impacted products
Vendor Product Version
Apache Software Foundation Apache Mynewt NimBLE Affected: 0 , ≤ 1.8 (semver)
Create a notification for this product.
Credits
雷重庆 <leicq@seu.edu.cn>
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2026-01-10T10:06:49.945Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://www.openwall.com/lists/oss-security/2026/01/08/2"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Apache Mynewt NimBLE",
          "vendor": "Apache Software Foundation",
          "versions": [
            {
              "lessThanOrEqual": "1.8",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "\u96f7\u91cd\u5e86 \u003cleicq@seu.edu.cn\u003e"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eOut-of-bounds Read vulnerability in Apache  NimBLE HCI H4 driver. Specially crafted HCI event could lead to invalid memory read in H4 driver.\u003c/p\u003e\u003cp\u003eThis issue affects Apache NimBLE: through 1.8.\u0026nbsp;\u003c/p\u003e\u003cp\u003eThis issue requires a broken or bogus Bluetooth controller and thus severity is considered low.\u003c/p\u003e\u003cp\u003eUsers are recommended to upgrade to version 1.9, which fixes the issue.\u003c/p\u003e"
            }
          ],
          "value": "Out-of-bounds Read vulnerability in Apache  NimBLE HCI H4 driver. Specially crafted HCI event could lead to invalid memory read in H4 driver.\n\nThis issue affects Apache NimBLE: through 1.8.\u00a0\n\nThis issue requires a broken or bogus Bluetooth controller and thus severity is considered low.\n\nUsers are recommended to upgrade to version 1.9, which fixes the issue."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "text": "low"
            },
            "type": "Textual description of severity"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-125",
              "description": "CWE-125 Out-of-bounds Read",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-01-10T09:46:35.789Z",
        "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
        "shortName": "apache"
      },
      "references": [
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/apache/mynewt-nimble/commit/b973df0c6cf7b30efbf8eb2cafdc1ee843464b76"
        },
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.apache.org/thread/32sm0944dyod4sdql77stgyw9xb2msc0"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Apache Mynewt NimBLE: Out-of-Bounds Write Vulnerability in NimBLE HCI H4 driver",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
    "assignerShortName": "apache",
    "cveId": "CVE-2025-53470",
    "datePublished": "2026-01-10T09:46:35.789Z",
    "dateReserved": "2025-06-30T13:43:23.389Z",
    "dateUpdated": "2026-01-10T10:06:49.945Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-53477 (GCVE-0-2025-53477)

Vulnerability from cvelistv5 – Published: 2026-01-10 09:45 – Updated: 2026-01-10 10:06
VLAI?
Title
Apache Mynewt NimBLE: NULL Pointer Dereference in NimBLE host HCI layer
Summary
NULL Pointer Dereference vulnerability in Apache Nimble. Missing validation of HCI connection complete or HCI command TX buffer could lead to NULL pointer dereference. This issue requires disabled asserts and broken or bogus Bluetooth controller and thus severity is considered low. This issue affects Apache NimBLE: through 1.8.0. Users are recommended to upgrade to version 1.9.0, which fixes the issue.
Severity ?
No CVSS data available.
CWE
  • CWE-476 - NULL Pointer Dereference
Assigner
References
Impacted products
Vendor Product Version
Apache Software Foundation Apache Mynewt NimBLE Affected: 0 , ≤ 1.8.0 (custom)
Create a notification for this product.
Credits
雷重庆 <leicq@seu.edu.cn>
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2026-01-10T10:06:51.559Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://www.openwall.com/lists/oss-security/2026/01/08/3"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Apache Mynewt NimBLE",
          "vendor": "Apache Software Foundation",
          "versions": [
            {
              "lessThanOrEqual": "1.8.0",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "\u96f7\u91cd\u5e86 \u003cleicq@seu.edu.cn\u003e"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eNULL Pointer Dereference vulnerability in Apache Nimble.\u003c/p\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eMissing validation of HCI connection complete or HCI command TX buffer could lead to NULL pointer dereference.\u003c/span\u003e\u003cbr\u003eThis issue requires disabled asserts and broken or bogus Bluetooth controller and thus severity is considered low.\u003cbr\u003e\u003cbr\u003e\u003cp\u003eThis issue affects Apache NimBLE: through 1.8.0.\u003c/p\u003e\u003cp\u003eUsers are recommended to upgrade to version 1.9.0, which fixes the issue.\u003c/p\u003e"
            }
          ],
          "value": "NULL Pointer Dereference vulnerability in Apache Nimble.\n\nMissing validation of HCI connection complete or HCI command TX buffer could lead to NULL pointer dereference.\nThis issue requires disabled asserts and broken or bogus Bluetooth controller and thus severity is considered low.\n\nThis issue affects Apache NimBLE: through 1.8.0.\n\nUsers are recommended to upgrade to version 1.9.0, which fixes the issue."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "text": "low"
            },
            "type": "Textual description of severity"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-476",
              "description": "CWE-476 NULL Pointer Dereference",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-01-10T09:45:27.630Z",
        "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
        "shortName": "apache"
      },
      "references": [
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/apache/mynewt-nimble/commit/0caf9baeb271ede85fcc5237ab87ddbf938600da"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/apache/mynewt-nimble/commit/3160b8c4c7ff8db4e0f9badcdf7df684b151e077"
        },
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.apache.org/thread/1dxthc132hwm2tzvjblrtnschcsbw2vo"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Apache Mynewt NimBLE: NULL Pointer Dereference in NimBLE host HCI layer",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
    "assignerShortName": "apache",
    "cveId": "CVE-2025-53477",
    "datePublished": "2026-01-10T09:45:27.630Z",
    "dateReserved": "2025-06-30T14:54:12.319Z",
    "dateUpdated": "2026-01-10T10:06:51.559Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-62235 (GCVE-0-2025-62235)

Vulnerability from cvelistv5 – Published: 2026-01-10 09:42 – Updated: 2026-01-10 10:07
VLAI?
Title
Apache Mynewt NimBLE: Incorrect handling of SMP Security Request could lead to undesirable pairing
Summary
Authentication Bypass by Spoofing vulnerability in Apache NimBLE. Receiving specially crafted Security Request could lead to removal of original bond and re-bond with impostor. This issue affects Apache NimBLE: through 1.8.0. Users are recommended to upgrade to version 1.9.0, which fixes the issue.
Severity ?
No CVSS data available.
CWE
  • CWE-290 - Authentication Bypass by Spoofing
Assigner
References
Impacted products
Vendor Product Version
Apache Software Foundation Apache Mynewt NimBLE Affected: 0 , ≤ 1.8.0 (semver)
Create a notification for this product.
Credits
Tommaso Sacchetti <tommaso.sacchetti@gmail.com>
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2026-01-10T10:07:12.051Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://www.openwall.com/lists/oss-security/2026/01/08/4"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Apache Mynewt NimBLE",
          "vendor": "Apache Software Foundation",
          "versions": [
            {
              "lessThanOrEqual": "1.8.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Tommaso Sacchetti \u003ctommaso.sacchetti@gmail.com\u003e"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eAuthentication Bypass by Spoofing vulnerability in Apache NimBLE.\u003c/p\u003eReceiving specially crafted Security Request could lead to removal of original bond\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003e\u0026nbsp;and re-bond with impostor.\u003c/span\u003e\u003cbr\u003e\u003cp\u003eThis issue affects Apache NimBLE: through 1.8.0.\u003c/p\u003e\u003cp\u003eUsers are recommended to upgrade to version 1.9.0, which fixes the issue.\u003c/p\u003e"
            }
          ],
          "value": "Authentication Bypass by Spoofing vulnerability in Apache NimBLE.\n\nReceiving specially crafted Security Request could lead to removal of original bond\u00a0and re-bond with impostor.\nThis issue affects Apache NimBLE: through 1.8.0.\n\nUsers are recommended to upgrade to version 1.9.0, which fixes the issue."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "text": "important"
            },
            "type": "Textual description of severity"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-290",
              "description": "CWE-290 Authentication Bypass by Spoofing",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-01-10T09:42:30.446Z",
        "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
        "shortName": "apache"
      },
      "references": [
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/apache/mynewt-nimble/commit/41f67e391e788c5feef9030026cc5cbc5431838a"
        },
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.apache.org/thread/rw2mrpfwb9d9wmq4h4b6ctcd6gpkk2ho"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Apache Mynewt NimBLE: Incorrect handling of SMP Security Request could lead to undesirable pairing",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
    "assignerShortName": "apache",
    "cveId": "CVE-2025-62235",
    "datePublished": "2026-01-10T09:42:30.446Z",
    "dateReserved": "2025-10-09T15:28:28.169Z",
    "dateUpdated": "2026-01-10T10:07:12.051Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}