CVE-2026-46452: Apache Nimble DOS Vulnerability

CVE-2026-46452 Overview

CVE-2026-46452 is an Improper Input Validation vulnerability [CWE-20] in Apache NimBLE affecting the Bluetooth Mesh Proxy Segmentation and Reassembly (SAR) logic. The flaw exists in nimble/host/mesh/src/proxy_msg.c, where the proxy role buffer is not validated for available tailroom before appending incoming segment data. A network-adjacent attacker sending crafted Mesh Proxy PDUs can force reassembly of malformed data, passing broken payloads to the application layer. The result is memory pressure and unstable parsing behavior in the Bluetooth Low Energy (BLE) host stack. The vulnerability affects Apache NimBLE through version 1.9.0 and is fixed in 1.10.0.

Critical Impact
Remote attackers can trigger buffer overflow conditions during Mesh Proxy SAR reassembly, degrading BLE stack availability on affected NimBLE-based devices.

Affected Products

Apache NimBLE versions up to and including 1.9.0
Apache Mynewt-NimBLE Bluetooth Mesh Proxy component
Embedded and IoT devices using the NimBLE host stack for BLE Mesh

Discovery Timeline

2026-07-24 - CVE-2026-46452 published to NVD
2026-07-27 - Last updated in NVD database

Technical Details for CVE-2026-46452

Vulnerability Analysis

Apache NimBLE implements Bluetooth Mesh Proxy Protocol, which uses SAR to fragment and reassemble mesh PDUs that exceed the maximum GATT MTU. The reassembly routine in proxy_msg.c copies incoming segment data into a role->buf reassembly buffer without first confirming the buffer has sufficient tailroom for the incoming length. When an attacker within BLE range submits crafted SAR segments whose combined length exceeds the buffer capacity, the reassembly logic passes broken or truncated data upward to the application layer. This produces memory pressure and unstable parsing behavior in downstream mesh handlers.

Root Cause

The root cause is a missing bounds check between net_buf_simple_tailroom(role->buf) and the incoming segment length prior to reassembly. Because SAR state accumulates across multiple proxy messages, an attacker controls the effective payload size arriving at the buffer. Without a tailroom guard, the code path continues switching on PDU_SAR(data) and processing malformed content, violating [CWE-20] Improper Input Validation semantics.

Attack Vector

Exploitation requires network reachability to the BLE Mesh Proxy interface. No authentication or user interaction is required. An attacker sends malformed proxy PDUs with inconsistent SAR headers and oversized payloads to force reassembly failures and application-layer instability.

// Security patch in nimble/host/mesh/src/proxy_msg.c
// Check buffer space before relaying proxy message
 {
 	const uint8_t *data = buf;
 
+	if (net_buf_simple_tailroom(role->buf) < len - 1) {
+		BT_WARN("Proxy role buffer overflow");
+		return -EINVAL;
+	}
+
 	switch (PDU_SAR(data)) {
 	case SAR_COMPLETE:
 		if (role->buf->om_len) {

Source: Apache mynewt-nimble commit 593f9522. The patch adds an explicit tailroom check that returns -EINVAL and emits a BT_WARN before touching the reassembly state machine.

Detection Methods for CVE-2026-46452

Indicators of Compromise

BT_WARN("Proxy role buffer overflow") log entries emitted by patched NimBLE builds indicate an attempted overflow.
Unexpected BLE Mesh Proxy disconnections or repeated GATT reconnection attempts from a single peer.
Application-layer mesh parsing errors correlated with malformed SAR segment sequences.

Detection Strategies

Instrument NimBLE-based firmware to log SAR state transitions and buffer utilization on the proxy role.
Use BLE sniffers (for example, nRF Sniffer or Ellisys) to capture Mesh Proxy PDUs and flag PDUs whose cumulative SAR length exceeds negotiated MTU expectations.
Compare deployed firmware versions against Apache NimBLE 1.9.0 and earlier in software bill of materials (SBOM) inventories.

Monitoring Recommendations

Aggregate BLE stack warning logs from managed IoT fleets and alert on repeated proxy buffer warnings from the same source address.
Track firmware versions across BLE Mesh gateways and provisioners to identify unpatched NimBLE instances.
Monitor mesh network reliability metrics for spikes in reassembly errors or dropped proxy sessions.

How to Mitigate CVE-2026-46452

Immediate Actions Required

Upgrade Apache NimBLE to version 1.10.0 or later on all affected devices.
Inventory embedded products, IoT gateways, and mobile companion firmware that bundle NimBLE and prioritize those exposed to untrusted BLE environments.
Coordinate with device vendors to obtain patched firmware for downstream products that vendor NimBLE.

Patch Information

The fix is delivered in Apache NimBLE 1.10.0 via commit 593f9522, which adds a net_buf_simple_tailroom check to the proxy reassembly path. Reference the Apache NimBLE mailing list advisory and the upstream commit for integration guidance. Additional discussion is available on the Openwall oss-security list.

Workarounds

Disable the Bluetooth Mesh Proxy feature on devices that do not require GATT-based mesh access until patched firmware is deployed.
Restrict BLE Mesh provisioning and proxy connectivity to trusted physical zones to reduce attacker reachability.
Apply the upstream commit as a backport for products that cannot immediately move to NimBLE 1.10.0.

bash

# Verify installed Apache NimBLE version in a Mynewt project
newt info | grep -i nimble

# Update NimBLE dependency to a patched release
newt upgrade @apache-mynewt-nimble --version 1.10.0
newt build <target>