A reachable assertion vulnerability in Apache NimBLE versions 0 through 1.9.0 allows unauthenticated remote attackers to trigger a service crash and interrupt system availability.

This is a reachable assertion (CWE-617) vulnerability that occurs when a specific condition is met, causing the application to terminate unexpectedly. It is remotely exploitable (AV:N) and does not require authentication (PR:N), making it highly automatable.

The primary impact of this vulnerability is a denial of service. Because the flaw is easily triggered by remote, unauthenticated actors, it could be used to repeatedly crash critical infrastructure or IoT devices relying on the NimBLE stack, leading to significant operational downtime.

Immediate Action: Update to the latest version of Apache NimBLE to resolve the assertion failure.

Proactive Monitoring: Monitor device stability and logs for recurring assertion failures or unexpected service restarts that could indicate an ongoing DoS attempt.

Compensating Controls: Implement rate limiting or network-level traffic filtering to mitigate the ability of remote actors to send the triggering payloads to the NimBLE interface.

Public Exploit Available: No.

Due to the remote, unauthenticated nature of this vulnerability and its potential for service disruption, administrators should treat this as a priority update. Applying the vendor-supplied patch is the only effective way to prevent remote service crashes.