A high-severity NULL pointer dereference vulnerability in Apache NimBLE could lead to a denial of service condition when processing specific LE Long Term Key Request events.

The vulnerability is caused by a NULL pointer dereference (CWE-476) occurring during the processing of LE Long Term Key Request events. An unauthenticated attacker can potentially trigger this condition remotely.

Exploitation of this vulnerability leads to a denial of service, effectively crashing the affected service or device. This is particularly critical for systems relying on NimBLE for Bluetooth Low Energy connectivity, as it may result in prolonged outages and loss of service availability. The CVSS score of 7.5 underscores the severity of the potential impact on system stability.

Immediate Action: Review the Apache NimBLE project repository for official security updates and apply the fix corresponding to the identified upstream commit.

Proactive Monitoring: Monitor system logs for unexpected service crashes or restarts that may indicate an attempt to trigger the NULL pointer dereference.

Compensating Controls: Implement network-level access controls to restrict connections to the Bluetooth interface, thereby limiting the exposure to potential attackers.

Public Exploit Available: No

The risk of denial of service makes this vulnerability a priority for systems utilizing Apache NimBLE. Administrators and developers should monitor the Apache mailing lists and repository for the release of a stable patch and integrate the fix into their firmware or software builds as soon as it becomes available.