CVE-2026-45815

Reachable Assertion vulnerability in Apache NimBLE. A specially crafted ATT Read Multiple Variable Response (BLE_ATT_OP_READ_MULT_VAR_RSP) may trigger assert in ATT parser. Severity is medium as this requires DUT to first send ATT Read Multiple Variable Request. This issue affects Apache NimBLE: through 1.9.0. Users are recommended to upgrade to version 1.10.0, which fixes the issue.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/apache/mynewt-nimble/commit/fae6a4874309ba0175d2c444e20f8a6bde007425	Patch
https://lists.apache.org/thread/3d09hgo5zmm7dnryst3tb9857hk1bbos	Mailing List Vendor Advisory
http://www.openwall.com/lists/oss-security/2026/07/24/14	Mailing List Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:apache:nimble:*:*:*:*:*:*:*:*

History

24 Oct 2026, 13:10

Type	Values Removed	Values Added
Summary		(es) Vulnerabilidad de aserción alcanzable en Apache NimBLE. Una respuesta ATT Read Multiple Variable Response (BLE_ATT_OP_READ_MULT_VAR_RSP) especialmente diseñada puede activar una aserción en el analizador ATT. La severidad es media ya que esto requiere que el DUT envíe primero una solicitud ATT Read Multiple Variable Request. Este problema afecta a Apache NimBLE: hasta la versión 1.9.0. Se recomienda a los usuarios actualizar a la versión 1.10.0, la cual corrige el problema.

Information

Published : 2026-07-24 13:18

Updated : 2026-10-24 13:10

NVD link : CVE-2026-45815

Mitre link : CVE-2026-45815

CVE.ORG link : CVE-2026-45815

JSON object : View

Products Affected

apache

nimble

CWE

CWE-617

Reachable Assertion

{"id": "CVE-2026-45815", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-45815", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-24T18:20:30.342440Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security@apache.org", "affectedData": [{"vendor": "Apache Software Foundation", "product": "Apache NimBLE", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "1.9.0"}], "defaultStatus": "unaffected"}]}], "published": "2026-07-24T13:18:24.200", "references": [{"url": "https://github.com/apache/mynewt-nimble/commit/fae6a4874309ba0175d2c444e20f8a6bde007425", "tags": ["Patch"], "source": "security@apache.org"}, {"url": "https://lists.apache.org/thread/3d09hgo5zmm7dnryst3tb9857hk1bbos", "tags": ["Mailing List", "Vendor Advisory"], "source": "security@apache.org"}, {"url": "http://www.openwall.com/lists/oss-security/2026/07/24/14", "tags": ["Mailing List", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security@apache.org", "description": [{"lang": "en", "value": "CWE-617"}]}], "descriptions": [{"lang": "en", "value": "Reachable Assertion vulnerability in Apache NimBLE.\nA specially crafted\u00a0ATT Read Multiple Variable Response (BLE_ATT_OP_READ_MULT_VAR_RSP) may trigger assert in ATT parser.\n\nSeverity is medium as this requires DUT to first send ATT Read Multiple Variable Request.\n\nThis issue affects Apache NimBLE: through 1.9.0.\n\nUsers are recommended to upgrade to version 1.10.0, which fixes the issue."}, {"lang": "es", "value": "Vulnerabilidad de aserci\u00f3n alcanzable en Apache NimBLE.\nUna respuesta ATT Read Multiple Variable Response (BLE_ATT_OP_READ_MULT_VAR_RSP) especialmente dise\u00f1ada puede activar una aserci\u00f3n en el analizador ATT.\n\nLa severidad es media ya que esto requiere que el DUT env\u00ede primero una solicitud ATT Read Multiple Variable Request.\n\nEste problema afecta a Apache NimBLE: hasta la versi\u00f3n 1.9.0.\n\nSe recomienda a los usuarios actualizar a la versi\u00f3n 1.10.0, la cual corrige el problema."}], "lastModified": "2026-10-24T13:10:00.147", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:apache:nimble:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "86B88229-791C-4BFE-824F-9D9D981C81C9", "versionEndExcluding": "1.10.0"}], "operator": "OR"}]}], "sourceIdentifier": "security@apache.org"}