Apache Nimble
Monthly
A denial-of-service vulnerability in Apache NimBLE’s Mesh Proxy SAR reassembly can be exploited by remote attackers without authentication, causing memory pressure and unstable application behavior. Affected versions include all releases through 1.9.0; a vendor patch is available in version 1.10.0. No active exploitation or public proof-of-concept has been identified, and EPSS indicates a low likelihood of widespread exploitation.
Denial-of-service in Apache NimBLE up to version 1.9.0 allows remote attackers to crash the BLE host by causing a NULL pointer dereference in the LE Long Term Key Request event handler. Exploitation requires the host to be built with assertions disabled and a bogus or misbehaving BLE controller. No active exploitation or public exploit code has been identified; the vendor rates severity as low.
Denial of service in Apache NimBLE 1.9.0 and earlier allows a remote attacker to crash the BLE host stack via a crafted ATT Read Multiple Variable Response. The vulnerability is triggered when a vulnerable device, acting as a BLE Central, sends a Read Multiple Variable Request and receives a malicious response that causes an assertion failure in the ATT parser. Exploitation is not known to be active in the wild, and a patch is available in version 1.10.0.
Memory corruption in Apache NimBLE BASS service allows a nearby, paired attacker to exploit an integer underflow during parsing of Add Source or Modify Source PDUs, leading to a stack buffer overflow or arbitrary out-of-bounds read. This can result in full device compromise. No active exploitation or public exploit is known, and EPSS indicates low exploitation probability, but a vendor patch is available.
Apache NimBLE 1.9.0 and earlier mishandles multi-report HCI advertising events, potentially leaking heap memory when used with certain third-party Bluetooth controllers. The vulnerability is not under active exploitation and no public exploit code exists.
Buffer overflow in Apache NimBLE's HCI socket transport (through version 1.9.0) allows an adjacent attacker with a malicious or compromised Bluetooth controller to execute arbitrary code on the host by sending an oversized HCI event. Exploitation requires either a misconfigured event pool size or control of the controller on the HCI link, not over-the-air Bluetooth access. No active exploitation or public exploit code is known, and the real-world risk is low despite a CVSS 7.5 rating.
A denial-of-service vulnerability in Apache NimBLE’s Mesh Proxy SAR reassembly can be exploited by remote attackers without authentication, causing memory pressure and unstable application behavior. Affected versions include all releases through 1.9.0; a vendor patch is available in version 1.10.0. No active exploitation or public proof-of-concept has been identified, and EPSS indicates a low likelihood of widespread exploitation.
Denial-of-service in Apache NimBLE up to version 1.9.0 allows remote attackers to crash the BLE host by causing a NULL pointer dereference in the LE Long Term Key Request event handler. Exploitation requires the host to be built with assertions disabled and a bogus or misbehaving BLE controller. No active exploitation or public exploit code has been identified; the vendor rates severity as low.
Denial of service in Apache NimBLE 1.9.0 and earlier allows a remote attacker to crash the BLE host stack via a crafted ATT Read Multiple Variable Response. The vulnerability is triggered when a vulnerable device, acting as a BLE Central, sends a Read Multiple Variable Request and receives a malicious response that causes an assertion failure in the ATT parser. Exploitation is not known to be active in the wild, and a patch is available in version 1.10.0.
Memory corruption in Apache NimBLE BASS service allows a nearby, paired attacker to exploit an integer underflow during parsing of Add Source or Modify Source PDUs, leading to a stack buffer overflow or arbitrary out-of-bounds read. This can result in full device compromise. No active exploitation or public exploit is known, and EPSS indicates low exploitation probability, but a vendor patch is available.
Apache NimBLE 1.9.0 and earlier mishandles multi-report HCI advertising events, potentially leaking heap memory when used with certain third-party Bluetooth controllers. The vulnerability is not under active exploitation and no public exploit code exists.
Buffer overflow in Apache NimBLE's HCI socket transport (through version 1.9.0) allows an adjacent attacker with a malicious or compromised Bluetooth controller to execute arbitrary code on the host by sending an oversized HCI event. Exploitation requires either a misconfigured event pool size or control of the controller on the HCI link, not over-the-air Bluetooth access. No active exploitation or public exploit code is known, and the real-world risk is low despite a CVSS 7.5 rating.