CVE-2025-53477

CVSS 7.5v3.1pub. 2026-01-10upd. 2026-01-14

NULL Pointer Dereference vulnerability in Apache Nimble. Missing validation of HCI connection complete or HCI command TX buffer could lead to NULL pointer dereference. This issue requires disabled asserts and broken or bogus Bluetooth controller and thus severity is considered low. This issue affects Apache NimBLE: through 1.8.0. Users are recommended to upgrade to version 1.9.0, which fixes the issue.

oryginał EN

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Apache Nimble
APP
Apache
< 1.9.0

🔵

ZWERYFIKUJ U PRODUCENTA

Brak jednoznacznych danych o patchu. Sprawdź referencje od producenta.

CWE

CWE-476

Referencje

github.com/apache/mynewt-nimble/commit/0caf9baeb271ede8…

github.com/apache/mynewt-nimble/commit/3160b8c4c7ff8db4…

lists.apache.org/thread/1dxthc132hwm2tzvjblrtnschcsbw2v…

www.openwall.com/lists/oss-security/2026/01/08/3…

Powiązane podatności

CVE-2025-52435HIGH7.5ten sam produkt

J2EE Misconfiguration: Data Transmission Without Encryption vulnerability in Apache NimBLE. Improper handling...

CVE-2025-62235HIGH8.1ten sam produkt

Authentication Bypass by Spoofing vulnerability in Apache NimBLE. Receiving specially crafted Security Reques...

CVE-2024-51569HIGH7.5ten sam produkt

Out-of-bounds Read vulnerability in Apache NimBLE. Missing proper validation of HCI Number Of Completed Packe...

CVE-2024-24746HIGH7.5ten sam produkt

Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in Apache NimBLE. Specially crafted GAT...

CVE-2024-47250MEDIUM5.0ten sam produkt

Out-of-bounds Read vulnerability in Apache NimBLE. Missing proper validation of HCI advertising report could ...