{"id":"CVE-2026-45816","state":"PUBLISHED","title":"Apache NimBLE: NULL pointer dereference vulnerability in SMP LTK request","description":"NULL Pointer Dereference vulnerability in Apache NimBLE in LE Long Term Key Request event.\n\nThis requires disabled asserts (otherwise assert would trigger before NULL dereference) and bogus (or misbehaving) controller, thus severity is low.\n\nThis issue affects Apache NimBLE: through 1.9.0.\n\nUsers are recommended to upgrade to version 1.10.0, which fixes the issue.","publishedAt":"2026-07-24T12:11:09.434Z","updatedAt":"2026-07-24T18:22:34.523Z","severity":{"score":7.5,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","source":"CISA-ADP"},"assigner":"apache","products":["Apache Software Foundation Apache NimBLE"],"affected":[{"vendor":"Apache Software Foundation","product":"Apache NimBLE","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThanOrEqual":"1.9.0","versionType":"semver"}]}],"references":["https://github.com/apache/mynewt-nimble/commit/9448c5f495eb55018121b24a9dab5305c9222ea1","https://lists.apache.org/thread/psppdk5j8jnq1m4jn96tnfofspgqvzvn","http://www.openwall.com/lists/oss-security/2026/07/24/15"],"weaknesses":["CWE-476"],"ingestedAt":"2026-10-29T20:12:07.131Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/45xxx/CVE-2026-45816.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-45816","state":"PUBLISHED","datePublished":"2026-07-24T12:11:09.434Z","dateUpdated":"2026-07-24T18:22:34.523Z","assignerShortName":"apache","assignerOrgId":"f0158376-9dc2-43b6-827c-5f631a4d8d09","dateReserved":"2026-05-13T09:41:40.675Z"},"containers":{"cna":{"title":"Apache NimBLE: NULL pointer dereference vulnerability in SMP LTK request","descriptions":[{"lang":"en","value":"NULL Pointer Dereference vulnerability in Apache NimBLE in LE Long Term Key Request event.\n\nThis requires disabled asserts (otherwise assert would trigger before NULL dereference) and bogus (or misbehaving) controller, thus severity is low.\n\nThis issue affects Apache NimBLE: through 1.9.0.\n\nUsers are recommended to upgrade to version 1.10.0, which fixes the issue."}],"affected":[{"vendor":"Apache Software Foundation","product":"Apache NimBLE","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThanOrEqual":"1.9.0","versionType":"semver"}]}],"references":[{"url":"https://github.com/apache/mynewt-nimble/commit/9448c5f495eb55018121b24a9dab5305c9222ea1","tags":["patch"]},{"url":"https://lists.apache.org/thread/psppdk5j8jnq1m4jn96tnfofspgqvzvn","tags":["vendor-advisory"]}],"metrics":[{"other":{"content":{"text":"low"},"type":"Textual description of severity"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-476","description":"CWE-476 NULL Pointer Dereference","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"apache","orgId":"f0158376-9dc2-43b6-827c-5f631a4d8d09","dateUpdated":"2026-07-24T12:11:09.434Z"},"credits":[{"lang":"en","type":"reporter","value":"Chongqing Lei <leicq@seu.edu.cn>"}],"source":{"discovery":"UNKNOWN"},"x_generator":{"engine":"Vulnogram 0.2.0"}},"adp":[{"title":"CVE Program Container","references":[{"url":"http://www.openwall.com/lists/oss-security/2026/07/24/15"}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2026-07-24T14:34:47.365Z"}},{"title":"CISA ADP Vulnrichment","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.5,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"NONE"}},{"other":{"type":"ssvc","content":{"timestamp":"2026-07-24T18:22:09.194670Z","id":"CVE-2026-45816","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-07-24T18:22:34.523Z"}}]}}}