CVE-2026-46452
Received Received - Intake

Improper Input Validation in Apache NimBLE Mesh Proxy SAR

Publication date: 2026-07-24

Last updated on: 2026-07-24

Assigner: Apache Software Foundation

Description
Improper Input Validation vulnerability in Apache NimBLE in Mesh Proxy SAR reassembly could result in passing broken data toward application resulting in memory pressure and unstable parsing behavior. This issue affects Apache NimBLE: through 1.9.0. Users are recommended to upgrade to version 1.10.0, which fixes the issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-24
Last Modified
2026-07-24
Generated
2026-07-24
AI Q&A
2026-07-24
EPSS Evaluated
N/A
NVD
CVE-2026-46452
EUVD
EUVD-2026-48567

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
apache nimble to 1.10.0 (exc)
apache nimble 1.10.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-20 The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an Improper Input Validation issue in Apache NimBLE's Mesh Proxy SAR reassembly. It allows broken data to pass to the application, causing memory pressure and unstable parsing behavior. The flaw exists in versions up to 1.9.0 and is fixed in version 1.10.0.

Detection Guidance

Detection may involve monitoring logs for 'Proxy role buffer overflow' warnings in NimBLE mesh proxy operations. Check if your Apache NimBLE version is below 1.10.0. Review proxy_msg.c in nimble/host/mesh/src for buffer overflow attempts.

Impact Analysis

The vulnerability could lead to memory pressure and unstable parsing behavior, potentially causing crashes or unexpected behavior in applications using Apache NimBLE. Attackers might exploit it to trigger buffer overflows or corrupt data processing.

Compliance Impact

The vulnerability involves improper input validation in Apache NimBLE's Mesh Proxy SAR reassembly, which could lead to memory pressure and unstable parsing behavior. This may result in corrupted data being passed to applications, potentially causing system instability or crashes. While the direct impact on compliance standards like GDPR or HIPAA is not explicitly detailed in the provided context, such vulnerabilities could indirectly affect compliance by compromising data integrity or availability, which are key requirements under these regulations.

Mitigation Strategies

Upgrade Apache NimBLE to version 1.10.0 or later to address the improper input validation issue. If upgrading is not immediately possible, implement strict input validation for mesh proxy SAR reassembly to prevent broken data from reaching the application.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-46452. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart