CVE-2026-40944

Oxia: TLS CA certificate chain validation fails with multi-certificate PEM bundles

State: Published
Severity: 6.9 Medium
Published: Apr 21, 2026
Updated: Apr 22, 2026
Reserved: Apr 15, 2026

Description

Oxia is a metadata store and coordination system. Prior to 0.16.2, the trustedCertPool() function in the TLS configuration only parses the first PEM block from CA certificate files. When a CA bundle contains multiple certificates (e.g., intermediate + root CA), only the first certificate is loaded. This silently breaks certificate chain validation for mTLS. This vulnerability is fixed in 0.16.2.

Scores

CVSS	Score	Vector	Source
4.0	6.9 Medium	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N	GitHub_M

Weaknesses

CWE-295 Improper Certificate Validation

Affected Products

Product	Versions
oxiaoxia-db	< 0.16.2Affected

References

https://github.com/oxia-db/oxia/security/advisories/GHSA-7jrq-q4pq-rhm6

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.