CVE-2026-45811

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-45811

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-45811.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-45811

Published

2026-07-24T12:09:10.299Z

Modified

2026-08-12T16:09:37.372299Z

Severity

7.5 (High) CVSS_V3 - CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator

Summary

Apache NimBLE: Buffer overflow in socket HCI transport

Details

Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in Apache NimBLE. The HCI socket transport did not check whether a received HCI event would fit the configured event pool before copying it, allowing a buffer overflow. Severity is low: exploitation requires either a misconfigured pool size or a malicious/compromised controller on the other end of the HCI socket link, not over-the-air Bluetooth access.

This issue affects Apache NimBLE: through 1.9.0.

Users are recommended to upgrade to version 1.10.0, which fixes the issue.

Database specific

{
    "cna_assigner": "apache",
    "cwe_ids": [
        "CWE-120"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/45xxx/CVE-2026-45811.json"
}

References

Affected packages

Git / github.com/apache/mynewt-nimble

Affected ranges

Type

GIT

Repo

https://github.com/apache/mynewt-nimble

Events

Introduced

Fixed

a7a156f28954819e158b62dd613008f22f9cf73b

Fixed

dcc4e4f026109eecd507de9479bb5019306a4a41

Database specific

Show details

{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "1.10.0"
        }
    ],
    "cpe": "cpe:2.3:a:apache:nimble:*:*:*:*:*:*:*:*",
    "source": [
        "CPE_RANGE",
        "REFERENCES"
    ]
}

Affected versions

Other

nimble_1_5_0_rc1_tag

nimble_1_5_0_tag

nimble_1_6_0_rc1_tag

nimble_1_6_0_tag

nimble_1_7_0_rc1_tag

nimble_1_7_0_tag

nimble_1_8_0_rc1_tag

nimble_1_8_0_tag

nimble_1_9_0_rc1_tag

nimble_1_9_0_tag

Database specific

vanir_signatures_modified

"2026-08-12T16:09:37Z"

vanir_signatures

[
    {
        "source": "https://github.com/apache/mynewt-nimble/commit/dcc4e4f026109eecd507de9479bb5019306a4a41",
        "target": {
            "file": "nimble/transport/socket/src/ble_hci_socket.c"
        },
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "305133216105487713854478443148965419396",
                "191399666240777906614153336694585206296",
                "189328387510238465752728574520283989336",
                "144523109083615469965045570938412106445"
            ]
        },
        "signature_version": "v1",
        "signature_type": "Line",
        "id": "CVE-2026-45811-345fc104",
        "deprecated": false
    },
    {
        "source": "https://github.com/apache/mynewt-nimble/commit/dcc4e4f026109eecd507de9479bb5019306a4a41",
        "target": {
            "function": "ble_hci_sock_rx_msg",
            "file": "nimble/transport/socket/src/ble_hci_socket.c"
        },
        "digest": {
            "length": 3300.0,
            "function_hash": "330403379549844843441145149534594783226"
        },
        "signature_version": "v1",
        "signature_type": "Function",
        "id": "CVE-2026-45811-c4a696df",
        "deprecated": false
    }
]

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-45811.json"