At the Bluetooth SIG, we strive to make Bluetooth the global standard for simple, secure wireless connectivity and security is of the utmost importance.  If you have found a potential security issue in any Bluetooth specification, please contact us via email at [email protected].  For encrypted communication, you may use our public key.

We do our best to respond to security issues within 48 hours, but if you do not receive a response within this time frame, please feel free to follow up with us to ensure that we have received your original report.

Report Details
The following information will help us to evaluate your submission as quickly as possible. If available, please include in your report:

  • Vulnerability type (security, privacy, availability/DoS, etc.)
  • Affected specification and version
  • Instructions to reproduce the issue
  • A proof-of-concept (PoC)

Bluetooth Security Notices

Vulnerability Publication Date Details Specifications Affected CVE [NVD]
Exploiting Cross-Transport Key Derivation 09/09/2020 SIG Security Notice Core Spec, v4.2 to 5.0 CVE-2020-15802
Pairing Method Confusion 05/18/2020 SIG Security Notice

Core Spec, v2.1 to v5.2

Bluetooth Impersonation Attacks 05/18/2020 SIG Security Notice

Core Spec, v2.1 to v5.2

Key Negotiation of Bluetooth 08/13/2019 SIG Security Notice Core Spec, v4.2, v5.0 and v5.1 CVE-2019-9506
Validation of Elliptic Curve Parameters 07/23/2018 SIG Security Notice Core Spec, v2.1 to v5.0 CVE-2018-5383