CVE-2026-45815: 
NixOS vulnerability analysis and mitigation

CVE-2026-45815 is a Reachable Assertion vulnerability in Apache NimBLE, an open-source Bluetooth Low Energy (BLE) stack. A specially crafted ATT Read Multiple Variable Response (BLE_ATT_OP_READ_MULT_VAR_RSP) can trigger an assertion failure in the ATT parser, causing a denial of service. All versions of Apache NimBLE through 1.9.0 are affected; version 1.10.0 resolves the issue. The vulnerability was disclosed on July 24, 2026, and carries a CVSS v3.1 base score of 7.5 (High) (Apache Advisory, Github Advisory).

The root cause is classified as CWE-617 (Reachable Assertion): the ATT parser in ble_gattc.c contained a hard assert() statement (assert(i == proc->read_mult.num_handles)) that could be triggered by a malformed or mismatched ATT Read Multiple Variable Response from a remote peer (GitHub Commit). The fix refactors the response parsing to gracefully handle cases where the number of returned values does not match the request, or where LV (Length-Value) parsing indicates an incorrect format, replacing the assert with proper error reporting to the application. A precondition for exploitation is that the Device Under Test (DUT) must have first sent an ATT Read Multiple Variable Request — meaning the attacker must be able to respond to such a request as a BLE peripheral or MITM, or craft a response in a context where the DUT initiates the exchange (oss-security).

Successful exploitation causes the NimBLE host stack to crash via an assertion failure, resulting in a denial of service with high availability impact. There is no confidentiality or integrity impact, as the vulnerability only affects availability. Embedded and IoT devices running Apache NimBLE (e.g., those built on Apache Mynewt) could be rendered unresponsive, potentially requiring a reboot to recover (Github Advisory, oss-security).

1. Identify target: Locate a BLE device running Apache NimBLE through 1.9.0 that acts as a GATT client and is capable of issuing ATT Read Multiple Variable Requests.
2. Act as a malicious GATT server: Set up a rogue BLE peripheral (e.g., using a custom BLE stack or modified firmware) that the target device connects to, or position as a man-in-the-middle on an existing BLE connection.
3. Trigger a Read Multiple Variable Request: Wait for or induce the target DUT to send a BLE_ATT_OP_READ_MULT_VAR_REQ to the attacker-controlled server.
4. Send a crafted response: Reply with a malformed BLE_ATT_OP_READ_MULT_VAR_RSP where the number of attribute values in the response does not match the number requested, or where the LV (Length-Value) encoding is intentionally malformed.
5. Trigger assertion: The NimBLE ATT parser processes the malformed response, reaches the assert(i == proc->read_mult.num_handles) statement, and the assertion fails, crashing the NimBLE host stack and causing a denial of service on the target device (GitHub Commit, oss-security).

• Process/System: Unexpected crash or reset of a device running Apache NimBLE; assertion failure logs from the NimBLE host stack referencing ble_gattc.c and the read_mult procedure.
• Logs: Log entries indicating an assertion failure in the ATT parser, specifically around ble_gattc_read_mult_cb_var or similar GATT client functions; error codes related to BLE_HS_EBADDATA or unexpected BLE host resets.
• Network/BLE: Unexpected or repeated BLE disconnections from a specific peer device; anomalous BLE_ATT_OP_READ_MULT_VAR_RSP packets with mismatched or malformed LV-encoded attribute data observed in BLE traffic captures.

Users should upgrade Apache NimBLE to version 1.10.0, which replaces the reachable assertion with proper error handling and graceful failure reporting (Apache Advisory, GitHub Commit). No configuration-based workaround is documented; the only remediation is upgrading to the patched version. Organizations should prioritize patching devices exposed to untrusted BLE environments or networks.

The vulnerability was reported by researcher Amemoyoi (GitHub: @Amemoyoi) and disclosed by Apache NimBLE maintainer Szymon Janc via the oss-security mailing list on July 24, 2026 (oss-security). No significant broader media coverage or notable community debate has been observed beyond standard vulnerability tracking and aggregation sites.