CVE-2026-40944 - Oxia: TLS CA certificate chain validation fails with multi-certificate PEM bundles

Back Back to CVE browser

HIGH

Oxia: TLS CA certificate chain validation fails with multi-certificate PEM bundles

Published Apr 21, 2026

8.0

HIGH

CVSS 4.0

EPSS 0.26%

Description

Oxia is a metadata store and coordination system. Prior to 0.16.2, the trustedCertPool() function in the TLS configuration only parses the first PEM block from CA certificate files. When a CA bundle contains multiple certificates (e.g., intermediate + root CA), only the first certificate is loaded. This silently breaks certificate chain validation for mTLS. This vulnerability is fixed in 0.16.2.

Affected products

Vendor Oxia-DB Product Oxia Default
n/a
- Version
  < 0.16.2
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Oxia-DB

Oxia

n/a

Version	Status	Constraints
< 0.16.2	affected	-

Ecosystem	Package	Introduced	Fixed
Go	github.com/oxia-db/oxia	0	0.16.2

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-295

Improper Certificate Validation

References (3)

https://github.com/advisories/GHSA-7jrq-q4pq-rhm6
Advisory
https://github.com/oxia-db/oxia/security/advisories/GHSA-7jrq-q4pq-rhm6
x_refsource_CONFIRM
https://nvd.nist.gov/vuln/detail/CVE-2026-40944

Link	Providers	Tags
https://github.com/advisories/GHSA-7jrq-q4pq-rhm6		Advisory
https://github.com/oxia-db/oxia/security/advisories/GHSA-7jrq-q4pq-rhm6		x_refsource_CONFIRM
https://nvd.nist.gov/vuln/detail/CVE-2026-40944