CVE-2025-52435

⚠️ high

Summary

J2EE Misconfiguration: Data Transmission Without Encryption vulnerability in Apache NimBLE. Improper handling of Pause Encryption procedure on Link Layer results in a previously encrypted connection being left in un-encrypted state allowing an eavesdropper to observe the remainder of the exchange. This issue affects Apache NimBLE: through <= 1.8.0. Users are recommended to upgrade to version 1.9.0, which fixes the issue.

CVSS Score

7.5

High

EPSS Score

0.0

Exploit Probability

Published Date

2026-01-10

First Seen: 2026-01-17

📊 Relative Risk Intelligence

This CVE is Moderate Risk - more severe than 68.5% of all 340,405 vulnerabilities in our database.

#107,108

Above average severity

Severity Percentile

🎯 CISA SSVC Assessment Updated: Jan 12, 2026

🔍 Exploitation Status

None

No known exploits

⚙️ Automatable

YES

Can be exploited automatically

💥 Technical Impact

Partial

Limited system impact

🏆 Discovered By

Henrik Schnor <henrik.schnor@mailbox.org> (reporter)

SSVC data provided by CISA

Last Modified 2026-01-14

Source NVD 🔗

CVSS Vector 3.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CWE IDs (Weakness Types)

CWE-5

📦 Affected Products 1

Vendor	Product	Status	Affected Versions
apache	nimble	Affected	< 1.9.0

🔗 References 4

https://github.com/apache/mynewt-nimble/commit/164f1...

Patch

https://github.com/apache/mynewt-nimble/commit/ec3d7...

Patch

https://lists.apache.org/thread/ow8dzpsqfh9llfclh5fz...

Mailing List Vendor Advisory

http://www.openwall.com/lists/oss-security/2026/01/08/1

Mailing List Third Party Advisory

🔗 Related CVEs 6

CVE ID	Severity	CVSS	EPSS	Summary	Published
CVE-2026-45811	⚠️ high	7.5	0.3	Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in Apache NimBLE. The HCI socket tr...	2026-07-24
CVE-2026-45812	🔶 medium	6.5	0.4	Incorrect Calculation of Buffer Size vulnerability in Apache NimBLE when processing Legacy Advertising Report HCI event...	2026-07-24
CVE-2026-45813	⚠️ high	8.8	0.4	Out-of-bounds Write, Integer Underflow (Wrap or Wraparound) vulnerability in Apache NimBLE BASS service. Improper valida...	2026-07-24
CVE-2026-45815	⚠️ high	7.5	0.6	Reachable Assertion vulnerability in Apache NimBLE. A specially crafted ATT Read Multiple Variable Response (BLE_ATT_OP...	2026-07-24
CVE-2026-45816	⚠️ high	7.5	0.6	NULL Pointer Dereference vulnerability in Apache NimBLE in LE Long Term Key Request event. This requires disabled asse...	2026-07-24
CVE-2026-46452	🔶 medium	5.3	0.6	Improper Input Validation vulnerability in Apache NimBLE in Mesh Proxy SAR reassembly could result in passing broken dat...	2026-07-24

These CVEs affect the same products