CVE-2026-46452

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-46452

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-46452.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-46452

Published

2026-07-24T12:11:42.453Z

Modified

2026-08-12T16:24:41.135119Z

Severity

5.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVSS Calculator

Summary

Apache NimBLE: Mesh Proxy SAR reassembly unbounded append and unchecked failure

Details

Improper Input Validation vulnerability in Apache NimBLE in Mesh Proxy SAR reassembly could result in passing broken data toward application resulting in memory pressure and unstable parsing behavior.

This issue affects Apache NimBLE: through 1.9.0.

Users are recommended to upgrade to version 1.10.0, which fixes the issue.

Database specific

{
    "cna_assigner": "apache",
    "cwe_ids": [
        "CWE-20"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/46xxx/CVE-2026-46452.json"
}

References

Affected packages

Git / github.com/apache/mynewt-nimble

Affected ranges

Type

GIT

Repo

https://github.com/apache/mynewt-nimble

Events

Introduced

Fixed

a7a156f28954819e158b62dd613008f22f9cf73b

Fixed

593f95227a4073efde840a9bb34614929dfa7ed1

Database specific

Show details

{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "1.10.0"
        }
    ],
    "source": [
        "CPE_RANGE",
        "REFERENCES"
    ],
    "cpe": "cpe:2.3:a:apache:nimble:*:*:*:*:*:*:*:*"
}

Affected versions

Other

nimble_1_5_0_rc1_tag

nimble_1_5_0_tag

nimble_1_6_0_rc1_tag

nimble_1_6_0_tag

nimble_1_7_0_rc1_tag

nimble_1_7_0_tag

nimble_1_8_0_rc1_tag

nimble_1_8_0_tag

nimble_1_9_0_rc1_tag

nimble_1_9_0_tag

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-46452.json"

vanir_signatures

[
    {
        "target": {
            "function": "bt_mesh_proxy_msg_recv",
            "file": "nimble/host/mesh/src/proxy_msg.c"
        },
        "deprecated": false,
        "source": "https://github.com/apache/mynewt-nimble/commit/593f95227a4073efde840a9bb34614929dfa7ed1",
        "id": "CVE-2026-46452-536fab75",
        "signature_version": "v1",
        "digest": {
            "length": 1499.0,
            "function_hash": "102101100617841099553291266074831724474"
        },
        "signature_type": "Function"
    },
    {
        "target": {
            "file": "nimble/host/mesh/src/proxy_msg.c"
        },
        "deprecated": false,
        "source": "https://github.com/apache/mynewt-nimble/commit/593f95227a4073efde840a9bb34614929dfa7ed1",
        "id": "CVE-2026-46452-a65b2497",
        "signature_version": "v1",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "22177705674868237280594382400006852507",
                "237143470499387563007552067374643025210",
                "14326563823547409250577606119394639081"
            ]
        },
        "signature_type": "Line"
    }
]

vanir_signatures_modified

"2026-08-12T16:24:41Z"