CVE-2026-45816

UNKNOWN 0.0

Apache NimBLE: NULL pointer dereference vulnerability in SMP LTK request

CVSS Score

0.0

EPSS Score

0.0%

EPSS Percentile

0th

NULL Pointer Dereference vulnerability in Apache NimBLE in LE Long Term Key Request event. This requires disabled asserts (otherwise assert would trigger before NULL dereference) and bogus (or misbehaving) controller, thus severity is low. This issue affects Apache NimBLE: through 1.9.0. Users are recommended to upgrade to version 1.10.0, which fixes the issue.

CWE	CWE-476
Vendor	apache software foundation
Product	apache nimble
Published	Jul 24, 2026

Stay Ahead of the Next One

Get instant alerts for apache software foundation apache nimble

Be the first to know when new unknown vulnerabilities affecting apache software foundation apache nimble are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

Apache Software Foundation / Apache NimBLE

0 ≤ 1.9.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/apache/mynewt-nimble/commit/9448c5f495eb55018121b24a9dab5305c9222ea1 lists.apache.org: https://lists.apache.org/thread/psppdk5j8jnq1m4jn96tnfofspgqvzvn

Credits

🔍 Chongqing Lei <[email protected]>