CVE Intelligence

Vulnerabilidades do Apache Software Foundation Apache Mynewt NimBLE

🔔 Criar alerta RSS Verificador de versão

CVEs publicadas que afetam Apache Software Foundation Apache Mynewt NimBLE: 4 registro(s), com versões afetadas e correções.

CVE-2025-62235 Alta · 8.1 CWE-290 10/01/2026
Apache Mynewt NimBLE: Incorrect handling of SMP Security Request could lead to undesirable pairing
Authentication Bypass by Spoofing vulnerability in Apache NimBLE. Receiving specially crafted Security Request could lead to removal of original bond and re-bond with impostor. This issue affects Apache NimBLE: through 1.8.0. Users are recommended to upgrade to version 1.9.0, which fixes the issue.
CVE-2025-53477 Alta · 7.5 CWE-476 10/01/2026
Apache Mynewt NimBLE: NULL Pointer Dereference in NimBLE host HCI layer
NULL Pointer Dereference vulnerability in Apache Nimble. Missing validation of HCI connection complete or HCI command TX buffer could lead to NULL pointer dereference. This issue requires disabled asserts and broken or bogus Bluetooth controller and thus severity is considered low. This issue affects Apache NimBLE: through 1.8.0. Users are recommended to upgrade to version 1.9.0, which fixes the issue.
CVE-2025-53470 Baixa · 3.1 CWE-125 10/01/2026
Apache Mynewt NimBLE: Out-of-Bounds Write Vulnerability in NimBLE HCI H4 driver
Out-of-bounds Read vulnerability in Apache NimBLE HCI H4 driver. Specially crafted HCI event could lead to invalid memory read in H4 driver. This issue affects Apache NimBLE: through 1.8.  This issue requires a broken or bogus Bluetooth controller and thus severity is considered low. Users are recommended to upgrade to version 1.9, which fixes the issue.
CVE-2025-52435 Alta · 7.5 CWE-5 10/01/2026
Apache Mynewt NimBLE: Invalid error handling in pause encryption procedure in NimBLE controller
J2EE Misconfiguration: Data Transmission Without Encryption vulnerability in Apache NimBLE. Improper handling of Pause Encryption procedure on Link Layer results in a previously encrypted connection being left in un-encrypted state allowing an eavesdropper to observe the remainder of the exchange. This issue affects Apache NimBLE: through <= 1.8.0. Users are recommended to upgrade to version 1.9.0, which fixes the issue.