CVE-2026-45815
Received Received - Intake

Reachable Assertion in Apache NimBLE

Publication date: 2026-07-24

Last updated on: 2026-07-24

Assigner: Apache Software Foundation

Description
Reachable Assertion vulnerability in Apache NimBLE. A specially crafted ATT Read Multiple Variable Response (BLE_ATT_OP_READ_MULT_VAR_RSP) may trigger assert in ATT parser. Severity is medium as this requires DUT to first send ATT Read Multiple Variable Request. This issue affects Apache NimBLE: through 1.9.0. Users are recommended to upgrade to version 1.10.0, which fixes the issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-24
Last Modified
2026-07-24
Generated
2026-07-24
AI Q&A
2026-07-24
EPSS Evaluated
N/A
NVD
CVE-2026-45815
EUVD
EUVD-2026-48565

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
apache nimble to 1.9.0 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-617 The product contains an assert() or similar statement that can be triggered by an attacker, which leads to an application exit or other behavior that is more severe than necessary.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a Reachable Assertion vulnerability in Apache NimBLE where a specially crafted BLE ATT Read Multiple Variable Response may trigger an assert in the ATT parser. It requires the device under test to first send an ATT Read Multiple Variable Request. The issue affects versions up to and including 1.9.0.

Detection Guidance

This vulnerability requires the device to first send an ATT Read Multiple Variable Request before the crafted response can trigger the assert. Detection may involve monitoring BLE traffic for malformed ATT Read Multiple Variable Response packets or unexpected asserts in the NimBLE host stack logs. Check for crashes or error logs in the NimBLE application after sending such requests.

Impact Analysis

An attacker could exploit this to cause a denial of service by crashing the device running vulnerable NimBLE software. This requires the attacker to craft a malicious BLE response, which may not be feasible in all scenarios.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards. It is a software bug in Apache NimBLE that could cause crashes under specific conditions but does not involve data breaches or unauthorized access. Compliance impact would depend on how the affected system is used in a broader context.

Mitigation Strategies
  • Upgrade Apache NimBLE to version 1.10.0 or later to address the Reachable Assertion vulnerability.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-45815. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart