CVE-2025-62235

High · 8.1

CVSS

8.1

EPSS

0.4%

Published

Jan 10, 2026

CISA due date

—

The record

Authentication Bypass by Spoofing vulnerability in Apache NimBLE. Receiving specially crafted Security Request could lead to removal of original bond and re-bond with impostor. This issue affects Apache NimBLE: through 1.8.0. Users are recommended to upgrade to version 1.9.0, which fixes the issue.

Affected packages

Ecosystem	Package	Introduced	Fixed