Out-of-bounds Read in Apache Nimble
CVE-2024-51569
Out-of-bounds Read vulnerability in Apache NimBLE. Missing proper validation of HCI Number Of Completed Packets could lead to out-of-bound access when parsing HCI event and invalid read from HCI transport memory. This issue requires broken or bogus Bluetooth controller and thus severity is considered low. This issue affects Apache NimBLE: through 1.7.0. Users are recommended to upgrade to version 1.8.0, which fixes the issue.
Vulnerability class: Buffer Overflow
EPSS: 0.012 (63.8th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N.
Affected products
- Apache Nimble
- Apache Software Foundation Nimble — versions 0
Weakness classification (CWE)
References
- security@apache.org (vendor-advisory, Vendor Advisory)
- security@apache.org (Patch, patch)
- af854a3a-2127-422b-91ae-364da2661108 (Mailing List, Vendor Advisory)
Frequently asked questions
- What is CVE-2024-51569?
- CVE-2024-51569 is a high-severity vulnerability in Apache Nimble, classified under Out-of-bounds Read. CVSS score: 7.5/10. Published 2024-11-26.
- How severe is CVE-2024-51569?
- High severity. CVSS v3 base score is 7.5 out of 10.