CVE-2026-46452CWE-20

Apache NimBLE: Mesh Proxy SAR reassembly unbounded append and unchecked failure

Medium · published July 24, 2026

CVSS v3.1
5.3
EPSS
1%
Percentile
59.6
In the wild
Unconfirmed
What it is

Improper Input Validation vulnerability in Apache NimBLE in Mesh Proxy SAR reassembly could result in passing broken data toward application resulting in memory pressure and unstable parsing behavior.

This issue affects Apache NimBLE: through 1.9.0.

Users are recommended to upgrade to version 1.10.0, which fixes the issue.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
CVSS v4.0
Not supplied
EPSS
0.00908 · 59.6th percentile
Weakness
CWE-20 · Improper Input Validation
Published
2026-07-24T12:11Z
EPSS history
Timeline
  • 24 JUL 12:11Z
    Apache NimBLE: Mesh Proxy SAR reassembly unbounded append and unchecked failure
    cvelistv5