EUVD-2026-48567
GHSA-wfj4-rqg3-9346
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Primary rating from Vendor (apache) · only source for this CVE.
CVSS VectorVendor: apache
Lifecycle Timeline
4DescriptionCVE.org
Improper Input Validation vulnerability in Apache NimBLE in Mesh Proxy SAR reassembly could result in passing broken data toward application resulting in memory pressure and unstable parsing behavior.
This issue affects Apache NimBLE: through 1.9.0.
Users are recommended to upgrade to version 1.10.0, which fixes the issue.
AnalysisAI
A denial-of-service vulnerability in Apache NimBLE’s Mesh Proxy SAR reassembly can be exploited by remote attackers without authentication, causing memory pressure and unstable application behavior. Affected versions include all releases through 1.9.0; a vendor patch is available in version 1.10.0. No active exploitation or public proof-of-concept has been identified, and EPSS indicates a low likelihood of widespread exploitation.
More in Apache Nimble
View allMemory corruption in Apache NimBLE BASS service allows a nearby, paired attacker to exploit an integer underflow during
Denial of service in Apache NimBLE 1.9.0 and earlier allows a remote attacker to crash the BLE host stack via a crafted
Apache NimBLE 1.9.0 and earlier mishandles multi-report HCI advertising events, potentially leaking heap memory when use
Denial-of-service in Apache NimBLE up to version 1.9.0 allows remote attackers to crash the BLE host by causing a NULL p
Buffer overflow in Apache NimBLE's HCI socket transport (through version 1.9.0) allows an adjacent attacker with a malic
Same weakness CWE-20 – Improper Input Validation
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today