CVE-2026-46452: 
NixOS vulnerability analysis and mitigation

CVE-2026-46452 is an Improper Input Validation vulnerability in Apache NimBLE's Mesh Proxy SAR (Segmentation and Reassembly) reassembly mechanism that can result in broken data being passed to the application, causing memory pressure and unstable parsing behavior. It affects Apache NimBLE through version 1.9.0, and was disclosed on July 24, 2026, with a fix available in version 1.10.0. The vulnerability was reported by Yicheng Yang and carries a CVSS v3.1 base score of 5.3 (Medium) (Github Advisory, Openwall OSS-Sec).

The root cause is CWE-20 (Improper Input Validation) in the bt_mesh_proxy_msg_recv function within nimble/host/mesh/src/proxy_msg.c. Specifically, the code failed to check whether sufficient buffer space was available before appending incoming SAR message segments, allowing oversized or malformed PDUs to overflow the proxy role buffer and pass broken data to higher application layers. The fix, introduced in commit 593f952, adds a net_buf_simple_tailroom() check before appending data, returning -EINVAL and logging a warning if the buffer would overflow. An unauthenticated attacker reachable over the network can send specially crafted Bluetooth Mesh Proxy PDUs to trigger this condition without any privileges or user interaction (GitHub Commit, Github Advisory).

Successful exploitation results in a denial-of-service condition: the affected NimBLE service experiences memory pressure and unstable parsing behavior, potentially degrading or destabilizing the Bluetooth Mesh Proxy functionality. There is no impact on confidentiality or data integrity — the vulnerability is limited to availability (rated Low by CVSS). Embedded or IoT devices running Apache NimBLE as a Bluetooth Mesh Proxy node are the primary affected assets (Github Advisory, Openwall OSS-Sec).

The primary remediation is to upgrade Apache NimBLE to version 1.10.0 or later, which includes the buffer space check fix in the Mesh Proxy SAR reassembly code (Openwall OSS-Sec, GitHub Commit). If immediate patching is not feasible, implement network-level controls to restrict access to the NimBLE Mesh Proxy interface to trusted sources only, reducing exposure to unauthenticated attackers.

The vulnerability was disclosed by Apache committer Szymon Janc via the oss-security mailing list on July 24, 2026, crediting Yicheng Yang as the reporter (Openwall OSS-Sec). Community reaction has been minimal given the low-to-moderate severity rating and absence of public exploit code; automated vulnerability tracking services (VulDB, Vulners, CVEFeed) indexed the issue shortly after disclosure with no notable researcher commentary beyond the official advisory.