CVE-2024-24746highCWE-835

CVE-2024-24746: high-severity vulnerability in Apache NimBLE

Apache NimBLE: Denial of service in NimBLE Bluetooth stack

Published · Updated

Follow this CVE+ Monitor Apache NimBLE

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 7.5epss 1.4%
Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in Apache NimBLE.  Specially crafted GATT operation can cause infinite loop in GATT server leading to denial of service in Bluetooth stack or device. This issue affects Apache NimBLE: through 1.6.0. Users are recommended to upgrade to version 1.7.0, which fixes the issue.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected products
Apache Software Foundation · Apache NimBLE
Related CVEs — Apache NimBLE

In the same product, most dangerous first.

CVE-2024-51569HIGHApache NimBLE: Lack of input sanitization leading to out-of-bound reads in Number of Completed Packets HCI event handlerEPSS 1.2%CVE-2026-45816HIGHApache NimBLE: NULL pointer dereference vulnerability in SMP LTK requestEPSS 1.0%CVE-2026-45815HIGHApache NimBLE: Remote reachable assertion in ATT Read Multiple Variable Response handlerEPSS 1.0%CVE-2026-46452MEDIUMApache NimBLE: Mesh Proxy SAR reassembly unbounded append and unchecked failureEPSS 0.9%CVE-2024-47248MEDIUMApache NimBLE: Buffer overflow in NimBLE MESH Bluetooth stackEPSS 0.7%CVE-2026-45812MEDIUMApache NimBLE: OOB Read via sizeof(pointer) in Legacy Advertising Report HandlerEPSS 0.7%