PT-2026-1837 · Apache · Apache Nimble

Published 2026-01-09 · Updated 2026-01-12 · CVE-2025-62235

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Apache NimBLE versions through 1.8.0

Description A flaw exists in Apache NimBLE that allows authentication bypass through spoofing. Receiving a specially crafted Security Request can result in the removal of the original bond and re-bonding with an impostor.

Recommendations Upgrade to version 1.9.0.

Fix

Authentication Bypass by Spoofing

Weakness Enumeration

CWE-290

Related Identifiers

CVE-2025-62235

Affected Products

Apache Nimble

References · 9

• https://github.com/apache/mynewt-nimble/commit/41f67e391e788c5feef9030026cc5cbc5431838a · Patch
• https://osv.dev/vulnerability/CVE-2025-62235 · Vendor Advisory
• https://lists.apache.org/thread/rw2mrpfwb9d9wmq4h4b6ctcd6gpkk2ho · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-62235 · Security Note
• http://openwall.com/lists/oss-security/2026/01/08/4 · Note
• https://twitter.com/oss_security/status/2009491711190552598 · Twitter Post
• https://t.me/CVEtracker/41940 · Telegram Post
• https://twitter.com/TheHackerWire/status/2010773879732781516 · Twitter Post
• https://twitter.com/CVEnew/status/2009926038881525824 · Twitter Post