How many CVEs does the NVD list for my NimBLE version?
Counted are CVEs whose NVD configuration lists the version as vulnerable, queried on 27 October 2026 through the NVD API, without rejected entries. The NVD lists NimBLE as cpe:2.3:a:apache:nimble; forms with „mynewt“ or „esp-nimble“ return nothing.
Apache reported and scored all 15 CVEs as CNA; the NVD has no score of its own. Many need a manipulated Bluetooth controller or a non-default configuration; each CVE's description says so.
| Version, tag date | CVEs according to the NVD, of which CVSS 9.0 or higher |
|---|---|
| 1.10.0, 21 Jul 2026 (newest) | none |
| 1.9.0, 19 Dec 2025 | 6 CVEs, none at 9.0 or higher |
| 1.8.0, 25 Nov 2024 | 10 CVEs, none at 9.0 or higher |
| 1.7.0, 4 Apr 2024 | 14 CVEs, none at 9.0 or higher |
| 1.6.0, 7 Sep 2023 (base of ESP-IDF 5.3 to 6.1) | 15 CVEs, none at 9.0 or higher |
| 1.5.0, 6 May 2022 (base of ESP-IDF 5.1 and 5.2) | 15 CVEs, none at 9.0 or higher |
| 1.4.0, 7 Apr 2021 | 15 CVEs, none at 9.0 or higher |
curl -s "https://services.nvd.nist.gov/rest/json/cves/2.0?virtualMatchString=cpe:2.3:a:apache:nimble:1.6.0&noRejected" \
| jq .totalResults15Which NimBLE CVEs are the most severe?
The two highest scores concern the host stack and are reachable over the air.
| CVE, CVSS (Apache) | What, precondition, fixed in |
|---|---|
| CVE-2026-45813, 8.8 | Stack overflow in the BASS service (LE Audio) on „Add Source“ and „Modify Source“, over the air, after pairing. Fixed in 1.10.0. |
| CVE-2025-62235, 8.1 | A Security Request removes an existing bond; an attacker can pair again as a known device. Fixed in 1.9.0. |
| CVE-2024-24746, 7.5 | Infinite loop in the GATT server, denial of service. Fixed in 1.7.0. |
| CVE-2025-52435, 7.5 | „Pause Encryption“ in the link layer leaves the connection unencrypted. Affects the NimBLE controller. Fixed in 1.9.0. |
Which NimBLE fixes are in ESP-IDF?
ESP-IDF does not ship Apache NimBLE, but Espressif's own copy esp-nimble, since ESP-IDF 5.3 based on 1.6.0. The NVD counts 15 CVEs for that base. Espressif backports fixes and lists them in sbom.yml; we checked whether each commit listed there is in the state the ESP-IDF release pins.
CVE-2026-45813 does not affect the copy: it has no BASS service. ESP-IDF has CVEs of its own in Bluetooth provisioning (such as CVE-2026-45542), which are listed under ESP-IDF, not under NimBLE.
| ESP-IDF, release date | NimBLE base, Espressif fixes inside |
|---|---|
| 6.1, 27 Aug 2026 | 1.6.0; 9 of 13, missing CVE-2026-45811, -45815, -45816 and -46452 |
| 6.0.3, 2 Sep 2026 | 1.6.0; 10 of 13, missing CVE-2026-45811, -45815 and -46452 |
| 5.5.6, 16 Oct 2026 | 1.6.0; all 13 |
| 5.4.4, 17 Apr 2026 | 1.6.0; 5 of 13 |
| 5.3.6, 15 Sep 2026 | 1.6.0; all 13 |
| 5.2.8, 11 Sep 2026 and 5.1.7, 27 Jan 2026 | 1.5.0; not checked one by one |
Where is the NimBLE version in my firmware?
NimBLE compiles no version number into the binary; the version is only in the project's package description. Visible in the image are the controller name „NimBLE“, if the NimBLE controller is linked, and the default device name „nimble“, unless the application changes it.
For an ESP32 image the route is ESP-IDF: every ESP-IDF image carries the ESP-IDF version in its application descriptor (esp_app_desc, field idf_ver). The release then gives the NimBLE state it pins.
How do I check this by hand?
- 1
Read the NimBLE version in the project: for Mynewt
repository.yml, for ESP-IDF the base incomponents/bt/host/nimble/nimble/sbom.yml. - 2
In an ESP32 image read the ESP-IDF version and derive the NimBLE state from the release.
- 3
Query the NVD with
cpe:2.3:a:apache:nimble:<version>. - 4
For ESP-IDF read the list in
sbom.ymlagainst your state: it names the backported fixes. - 5
Check which parts are linked: many CVEs concern the controller, Mesh or LE Audio and only apply if those parts are in the build.
Can this run automatically?
LegacyMind reads the RTOS and the linked libraries with their versions from the build and checks each against the vulnerability sources, with the place in the build where it was found. If the binary proves no version, the field stays empty.
Questions
Which NimBLE version should I use?
Apache NimBLE 1.10.0 from 21 July 2026; the NVD lists no CVE for it. On the ESP32 an ESP-IDF release that contains all fixes, as of 27 October 2026 for example 5.5.6 or 5.3.6.
Is the newest ESP-IDF also the safest for NimBLE?
Not necessarily. ESP-IDF 6.1 from 27 August 2026 lacks four fixes from 2026 that 5.5.6 from 16 October 2026 contains. What counts is the NimBLE state the release pins.
Is a NimBLE vulnerability actively exploited?
As of 27 October 2026 no NimBLE vulnerability is in the CISA catalogue of known exploited vulnerabilities (catalogue version 2026.10.26).
Are there patch releases for NimBLE?
No. Apache has never published a release of the form 1.x.1; a fix ships with the next minor version.