CVE-2026-45815 Apache Software Foundation CVE debrief

Who should care

Users of Apache NimBLE through version 1.9.0, particularly those responsible for vulnerability management, security teams, and operators of affected platforms, should be aware of this vulnerability and take steps to upgrade to version 1.10.0. This involves reviewing and updating inventory to ensure all instances of Apache NimBLE are identified and patched. Additionally, monitoring for suspicious activity related to ATT Read Multiple Variable Requests is recommended.

Technical summary

A Reachable Assertion vulnerability exists in Apache NimBLE. A specially crafted ATT Read Multiple Variable Response may trigger an assertion in the ATT parser. This requires the Device Under Test (DUT) to first send an ATT Read Multiple Variable Request. The issue affects Apache NimBLE through version 1.9.0. The vulnerability is addressed in version 1.10.0. Users should review the official advisory and CVE record to validate affected scope, severity, and vendor guidance. Compensating controls for exposed systems should be reviewed while remediation is scheduled and verified.

Defensive priority

Medium priority should be given to upgrading Apache NimBLE to version 1.10.0 to mitigate this vulnerability. This is because the vulnerability requires DUT to first send ATT Read Multiple Variable Request, making it a medium priority issue. Users of Apache NimBLE through version 1.9.0 should be aware of this vulnerability and take steps to upgrade to version 1.10.0. Additionally, monitoring for suspicious activity related to ATT Read Multiple Variable Requests is recommended. Compensating controls for exposed systems should be reviewed while remediation is scheduled and verified. Exceptions, retest remediated assets, and close the item only after evidence is documented. Track relevant monitoring, detection, and logs for exposed assets that need extra review. Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up. Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance. Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed. Check if there are any compensating controls for exposed systems while remediation is scheduled and verified. Review if there are any exceptions, retest remediated assets, and close the item only after evidence is documented. Track if there are any relevant monitoring, detection, and logs for exposed assets that need extra review. Confirm if there are affected product deployments in managed environments and assign an owner for follow-up. Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance. Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed. Review compensating controls for exposed systems while remediation is scheduled and verified. Check relevant monitoring, detection, and logs for exposed assets that need extra review. Track exceptions, retest remediated assets, and close the item only after evidence is documented. Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up. Review the supplied official advisory or CVE record to a

Recommended defensive actions

• Upgrade Apache NimBLE to version 1.10.0
• Review and update inventory to ensure all instances of Apache NimBLE are identified and patched
• Monitor for suspicious activity related to ATT Read Multiple Variable Requests
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record was published on 2026-07-24T13:18:24.200Z and was last modified on 2026-07-27T14:41:01.180Z. The NVD entry is currently Analyzed. This information is based on the NVD entry and CVE record. The vulnerability affects Apache NimBLE through version 1.9.0. Users are recommended to upgrade to version 1.10.0. The severity is medium as this requires DUT to first send ATT Read Multiple Variable Request.

Official resources