PT-2026-64283 · Apache · Apache Nimble

CVE-2026-45816 · Published 2026-07-24 · Updated 2026-07-24

NVD

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

NULL Pointer Dereference vulnerability in Apache NimBLE in LE Long Term Key Request event.

This requires disabled asserts (otherwise assert would trigger before NULL dereference) and bogus (or misbehaving) controller, thus severity is low.

This issue affects Apache NimBLE: through 1.9.0.

Users are recommended to upgrade to version 1.10.0, which fixes the issue.

Fix

NULL Pointer Dereference

Weakness Enumeration

CWE-476

Related Identifiers

CVE-2026-45816

Affected Products

Apache Nimble

References · 4

• https://github.com/apache/mynewt-nimble/commit/9448c5f495eb55018121b24a9dab5305c9222ea1 · Patch
• https://lists.apache.org/thread/psppdk5j8jnq1m4jn96tnfofspgqvzvn · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-45816 · Security Note
• http://openwall.com/lists/oss-security/2026/07/24/15 · Note