CVE-2024-24746

Published: Apr 6, 2024Modified: Jun 17, 2026

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Exploitability: 3.9 / Impact: 3.6

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in Apache NimBLE. Specially crafted GATT operation can cause infinite loop in GATT server leading to denial of service in Bluetooth stack or device. This issue affects Apache NimBLE: through 1.6.0. Users are recommended to upgrade to version 1.7.0, which fixes the issue.

Affected (1)

Products: Apache: Nimble

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Apache Nimble	Before 1.7.0

Related CWEs

Loop with Unreachable Exit Condition ('Infinite Loop')

The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.

References (6)

http://www.openwall.com/lists/oss-security/2024/04/05/2

Source: security@apache.org

Mailing List

https://github.com/apache/mynewt-nimble/commit/d42a0ebe6632bd0c318560e4293a522634f60594

Source: security@apache.org

Patch

https://lists.apache.org/thread/bptkzc0o2ymjk8qqzqdmy39kcmh27078

Source: security@apache.org

Mailing List

http://www.openwall.com/lists/oss-security/2024/04/05/2

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing List

https://github.com/apache/mynewt-nimble/commit/d42a0ebe6632bd0c318560e4293a522634f60594

Source: af854a3a-2127-422b-91ae-364da2661108

Patch

https://lists.apache.org/thread/bptkzc0o2ymjk8qqzqdmy39kcmh27078

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing List

Timeline

No history available yet.