PT-2026-64282 · Apache · Apache Nimble

Amemoyoi · CVE-2026-45815 · Published 2026-07-24 · Updated 2026-07-24

NVD

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Reachable Assertion vulnerability in Apache NimBLE. A specially crafted ATT Read Multiple Variable Response (BLE ATT OP READ MULT VAR RSP) may trigger assert in ATT parser.

Severity is medium as this requires DUT to first send ATT Read Multiple Variable Request.

This issue affects Apache NimBLE: through 1.9.0.

Users are recommended to upgrade to version 1.10.0, which fixes the issue.

Fix

Assertion Failure

Weakness Enumeration

CWE-617

Related Identifiers

CVE-2026-45815

Affected Products

Apache Nimble

References · 4

• https://github.com/apache/mynewt-nimble/commit/fae6a4874309ba0175d2c444e20f8a6bde007425 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-45815 · Security Note
• https://lists.apache.org/thread/3d09hgo5zmm7dnryst3tb9857hk1bbos · Vendor Advisory
• http://openwall.com/lists/oss-security/2026/07/24/14 · Note