{"cve":"CVE-2026-40944","nvd":{"published":"2026-04-21T22:16:19.980","modified":"2026-06-17T10:45:55.313","status":"Deferred","description":"Oxia is a metadata store and coordination system. Prior to 0.16.2, the trustedCertPool() function in the TLS configuration only parses the first PEM block from CA certificate files. When a CA bundle contains multiple certificates (e.g., intermediate + root CA), only the first certificate is loaded. This silently breaks certificate chain validation for mTLS. This vulnerability is fixed in 0.16.2.","cvss_v4":{"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","score":6.9},"cvss_v3":null,"cwes":["CWE-295"],"references":["https://github.com/oxia-db/oxia/security/advisories/GHSA-7jrq-q4pq-rhm6"],"products":[],"source":"nvd","synced_at":"2026-10-19T22:30:49.762551342+00:00"},"epss":{"cve":"CVE-2026-40944","score":0.0016,"percentile":0.05207,"date":"2026-10-31"},"kev":null,"osv":[{"id":"GHSA-7jrq-q4pq-rhm6","url":"https://osv.dev/vulnerability/GHSA-7jrq-q4pq-rhm6","summary":"Oxia's TLS CA certificate chain validation fails with multi-certificate PEM bundles","modified":"2026-06-25T19:56:16.105359878Z","packages":[{"ecosystem":"Go","name":"github.com/oxia-db/oxia","purl":"pkg:golang/github.com/oxia-db/oxia","ranges":["<0.16.2"],"fixed":["0.16.2"]}]},{"id":"GO-2026-5226","url":"https://osv.dev/vulnerability/GO-2026-5226","summary":"Oxia's TLS CA certificate chain validation fails with multi-certificate PEM bundles in github.com/oxia-db/oxia","modified":"2026-06-25T19:45:16.800547092Z","packages":[{"ecosystem":"Go","name":"github.com/oxia-db/oxia","purl":"pkg:golang/github.com/oxia-db/oxia","ranges":["<0.16.2"],"fixed":["0.16.2"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}