GCVE - cpe:2.3:a:apache:nimble:*:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:apache:nimble:*:*:*:*:*:*:*:*

part: a version: * update: *

Vendor	Apache (`b0303047-b7dd-5cf8-abcc-71b7d9d80b95`)
Product	Nimble (`5ab42563-b9ae-5f44-bf72-89e00a179627`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from gcve-enriched-dumps CVE data

PURL mappings

PURL	Source	Last updated
No PURL mappings for this CPE yet.

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2025-62235`	vulnerable	2026-06-08 07:37:28.931833	Apache Mynewt NimBLE: Incorrect handling of SMP Security Request could lead to undesirable pairing Authentication Bypass by Spoofing vulnerability in Apache NimBLE. Receiving specially crafted Security Request could lead to removal of original bond and re-bond with impostor. This issue affects Apache NimBLE: through 1.8.0. Users are recommended to upgrade to version 1.9.0, which fixes the issue. Published: 2026-01-10T09:42:30.446Z Updated: 2026-01-12T16:45:27.886Z Open on db.gcve.eu Reference links https://github.com/apache/mynewt-nimble/commit/41f67e391e788c5feef9030026cc5cbc5431838a https://lists.apache.org/thread/rw2mrpfwb9d9wmq4h4b6ctcd6gpkk2ho	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2025-53477`	vulnerable	2026-06-08 07:31:14.593081	Apache Mynewt NimBLE: NULL Pointer Dereference in NimBLE host HCI layer NULL Pointer Dereference vulnerability in Apache Nimble. Missing validation of HCI connection complete or HCI command TX buffer could lead to NULL pointer dereference. This issue requires disabled asserts and broken or bogus Bluetooth controller and thus severity is considered low. This issue affects Apache NimBLE: through 1.8.0. Users are recommended to upgrade to version 1.9.0, which fixes the issue. Published: 2026-01-10T09:45:27.630Z Updated: 2026-01-12T16:54:48.496Z Open on db.gcve.eu Reference links https://github.com/apache/mynewt-nimble/commit/0caf9baeb271ede85fcc5237ab87ddbf938600da https://github.com/apache/mynewt-nimble/commit/3160b8c4c7ff8db4e0f9badcdf7df684b151e077 https://lists.apache.org/thread/1dxthc132hwm2tzvjblrtnschcsbw2vo	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2025-53470`	vulnerable	2026-06-08 07:31:14.582585	Apache Mynewt NimBLE: Out-of-Bounds Write Vulnerability in NimBLE HCI H4 driver Out-of-bounds Read vulnerability in Apache NimBLE HCI H4 driver. Specially crafted HCI event could lead to invalid memory read in H4 driver. This issue affects Apache NimBLE: through 1.8. This issue requires a broken or bogus Bluetooth controller and thus severity is considered low. Users are recommended to upgrade to version 1.9, which fixes the issue. Published: 2026-01-10T09:46:35.789Z Updated: 2026-01-12T19:12:52.715Z Open on db.gcve.eu Reference links https://github.com/apache/mynewt-nimble/commit/b973df0c6cf7b30efbf8eb2cafdc1ee843464b76 https://lists.apache.org/thread/32sm0944dyod4sdql77stgyw9xb2msc0	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2025-52435`	vulnerable	2026-06-08 07:31:11.580919	Apache Mynewt NimBLE: Invalid error handling in pause encryption procedure in NimBLE controller J2EE Misconfiguration: Data Transmission Without Encryption vulnerability in Apache NimBLE. Improper handling of Pause Encryption procedure on Link Layer results in a previously encrypted connection being left in un-encrypted state allowing an eavesdropper to observe the remainder of the exchange. This issue affects Apache NimBLE: through <= 1.8.0. Users are recommended to upgrade to version 1.9.0, which fixes the issue. Published: 2026-01-10T09:47:10.568Z Updated: 2026-01-12T19:07:07.593Z Open on db.gcve.eu Reference links https://github.com/apache/mynewt-nimble/commit/164f1c23c18a290908df76ed83fe848bfe4a4903 https://github.com/apache/mynewt-nimble/commit/ec3d75e909fa6dcadf1836fefc4432794a673d18 https://lists.apache.org/thread/ow8dzpsqfh9llfclh5fzh6z237brzc0s	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2024-51569`	vulnerable	2026-06-08 06:52:12.469941	Apache NimBLE: Lack of input sanitization leading to out-of-bound reads in Number of Completed Packets HCI event handler Out-of-bounds Read vulnerability in Apache NimBLE. Missing proper validation of HCI Number Of Completed Packets could lead to out-of-bound access when parsing HCI event and invalid read from HCI transport memory. This issue requires broken or bogus Bluetooth controller and thus severity is considered low. This issue affects Apache NimBLE: through 1.7.0. Users are recommended to upgrade to version 1.8.0, which fixes the issue. Published: 2024-11-26T11:17:56.337Z Updated: 2024-12-06T10:16:33.111Z Open on db.gcve.eu Reference links https://lists.apache.org/thread/q0vs5rddx1lho30xnpsrvpzgxqmywnhs https://github.com/apache/mynewt-nimble/commit/4e3ac5b6e7c7df63a594c4ff6839e266b4ccfed9	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2024-47250`	vulnerable	2026-06-08 06:48:11.621454	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2024-47249`	vulnerable	2026-06-08 06:48:11.620962	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2024-47248`	vulnerable	2026-06-08 06:48:11.620297	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2024-24746`	vulnerable	2026-06-08 06:29:41.646048	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.