Apache Mynewt NimBLE: Invalid error handling in pause encryp… (CVE-2025-52435)

Summary

Apache Mynewt NimBLE: Invalid error handling in pause encryption procedure in NimBLE controller

Original description

The description as published by the source.

J2EE Misconfiguration: Data Transmission Without Encryption vulnerability in Apache NimBLE.

Improper handling of Pause Encryption procedure on Link Layer results in a previously encrypted connection being left in un-encrypted state allowing an eavesdropper to observe the remainder of the exchange.
This issue affects Apache NimBLE: through <= 1.8.0.

Users are recommended to upgrade to version 1.9.0, which fixes the issue.

Source: OSV.dev (Open Source Vulnerabilities) NVD OSV

References

advisory github.com
advisory lists.apache.org
advisory nvd.nist.gov
patch github.com
patch github.com
web openwall.com