CVE-2025-52435

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-52435
J2EE Misconfiguration: Data Transmission Without Encryption vulnerability in Apache NimBLE. Improper handling of Pause Encryption procedure on Link Layer results in a previously encrypted connection being left in un-encrypted state allowing an eavesdropper to observe the remainder of the exchange. This issue affects Apache NimBLE: through <= 1.8.0. Users are recommended to upgrade to version 1.9.0, which fixes the issue.

7.5 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://github.com/apache/mynewt-nimble/commit/164f1c23c18a290908df76ed83fe848bfe4a4903 Patch
https://github.com/apache/mynewt-nimble/commit/ec3d75e909fa6dcadf1836fefc4432794a673d18 Patch
https://lists.apache.org/thread/ow8dzpsqfh9llfclh5fzh6z237brzc0s Mailing List Vendor Advisory
http://www.openwall.com/lists/oss-security/2026/01/08/1 Mailing List Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:apache:nimble:*:*:*:*:*:*:*:*
History

17 Jun 2026, 09:36

Type Values Removed Values Added
Summary
  • (es) Mala configuración de J2EE: vulnerabilidad de transmisión de datos sin cifrado en Apache NimBLE. El manejo inadecuado del procedimiento de Pausa de Cifrado en la Capa de Enlace provoca que una conexión previamente cifrada quede en estado sin cifrar, permitiendo a un fisgón observar el resto del intercambio. Este problema afecta a Apache NimBLE: hasta la versión 1.8.0 inclusive. Se recomienda a los usuarios actualizar a la versión 1.9.0, que corrige el problema.

14 Jan 2026, 16:30

Type Values Removed Values Added
CPE cpe:2.3:a:apache:nimble:*:*:*:*:*:*:*:*
References () https://github.com/apache/mynewt-nimble/commit/164f1c23c18a290908df76ed83fe848bfe4a4903 - () https://github.com/apache/mynewt-nimble/commit/164f1c23c18a290908df76ed83fe848bfe4a4903 - Patch
References () https://github.com/apache/mynewt-nimble/commit/ec3d75e909fa6dcadf1836fefc4432794a673d18 - () https://github.com/apache/mynewt-nimble/commit/ec3d75e909fa6dcadf1836fefc4432794a673d18 - Patch
References () https://lists.apache.org/thread/ow8dzpsqfh9llfclh5fzh6z237brzc0s - () https://lists.apache.org/thread/ow8dzpsqfh9llfclh5fzh6z237brzc0s - Mailing List, Vendor Advisory
References () http://www.openwall.com/lists/oss-security/2026/01/08/1 - () http://www.openwall.com/lists/oss-security/2026/01/08/1 - Mailing List, Third Party Advisory
First Time Apache nimble
Apache

12 Jan 2026, 19:16

Type Values Removed Values Added
CWE CWE-5
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 7.5

10 Jan 2026, 10:15

Type Values Removed Values Added
New CVE
Information

Published : 2026-01-10 10:15

Updated : 2026-06-17 09:36

NVD link : CVE-2025-52435

Mitre link : CVE-2025-52435

CVE.ORG link : CVE-2025-52435

JSON object : View

Products Affected

apache

  • nimble
CWE
CWE-5

J2EE Misconfiguration: Data Transmission Without Encryption