CVE-2025-52435

Apache Mynewt NimBLE: Invalid error handling in pause encryption procedure in NimBLE controller

High · published January 10, 2026

CVSS v3.1
7.5
EPSS
0%
Percentile
13.9
In the wild
Unconfirmed
What it is

⚡ A misconfiguration in Apache NimBLE leaves your data like an open book, just waiting for someone to read it! 📖 Think of it like a hotel lobby conversation where guests are whispering secrets without realizing that a hidden recorder is capturing every word. Without proper encryption, your data becomes as vulnerable as that chat, easily intercepted by curious eavesdroppers. An attacker listening in could intercept sensitive data transmitted over the connection, potentially exposing confidential information. This could lead to unauthorized access, data leaks, or even more severe breaches if the information is sensitive enough. Imagine your private messages being read by strangers – absolutely devastating!

Put simply

Think of it like a hotel lobby conversation where guests are whispering secrets without realizing that a hidden recorder is capturing every word. Without proper encryption, your data becomes as vulnerable as that chat, easily intercepted by curious eavesdroppers. This vulnerability stems from improper handling of the Pause Encryption procedure on the Link Layer, which allows a previously encrypted connection to remain un-encrypted during the data exchange.

What to do

An attacker listening in could intercept sensitive data transmitted over the connection, potentially exposing confidential information. This could lead to unauthorized access, data leaks, or even more severe breaches if the information is sensitive enough. Imagine your private messages being read by strangers – absolutely devastating! Upgrade immediately to Apache NimBLE version 1.9.0, which addresses this misconfiguration. Review your existing encryption practices to ensure all connections are secured properly. Don't let your data have a 'free pass'! With these steps, you're on your way to securing your connections like a pro! You've got this! 🛡️

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00237 · 13.9th percentile
Published
2026-01-10T09:47Z
EPSS history
Timeline
  • 10 JAN 09:47Z
    Apache Mynewt NimBLE: Invalid error handling in pause encryption procedure in NimBLE controller
    cvelistv5