Unrated severityOSV Advisory· Published Jan 10, 2026· Updated Jan 12, 2026

Apache Mynewt NimBLE: Invalid error handling in pause encryption procedure in NimBLE controller

CVE-2025-52435

Description

J2EE Misconfiguration: Data Transmission Without Encryption vulnerability in Apache NimBLE.

Improper handling of Pause Encryption procedure on Link Layer results in a previously encrypted connection being left in un-encrypted state allowing an eavesdropper to observe the remainder of the exchange. This issue affects Apache NimBLE: through <= 1.8.0.

Users are recommended to upgrade to version 1.9.0, which fixes the issue.

Affected products

Apache/Mynewt NimbleOSV
Range: nimble_1_5_0_rc1_tag, nimble_1_5_0_tag, nimble_1_6_0_rc1_tag, …
Apache/NimBLEllm-fuzzy
Range: <=1.8.0

Patches

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

github.com/apache/mynewt-nimble/commit/164f1c23c18a290908df76ed83fe848bfe4a4903mitrepatch
github.com/apache/mynewt-nimble/commit/ec3d75e909fa6dcadf1836fefc4432794a673d18mitrepatch
lists.apache.org/thread/ow8dzpsqfh9llfclh5fzh6z237brzc0smitrevendor-advisory

News mentions

No linked articles in our index yet.

cvss	0.000
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000