CVSS 4.0
6.9 mediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:NCVE-2026-40944
Medium (6.9). EPSS 0.2% chance of exploitation in the next 30 days. Fixed in github.com/oxia-db/oxia 0.16.2.
Oxia is a metadata store and coordination system. Prior to 0.16.2, the trustedCertPool() function in the TLS configuration only parses the first PEM block from CA certificate files. When a CA bundle contains multiple certificates (e.g., intermediate + root CA), only the first certificate is loaded. This silently breaks certificate chain validation for mTLS. This vulnerability is fixed in 0.16.2.
Severity
- EPSS
- 0.2% chance of exploitation in the next 30 days; higher than 5% of CVEs (scores of 2026-10-31)
- CWE
- CWE-295
- Published
- Modified
- Record from
- the NVD, synced
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-7jrq-q4pq-rhm6 | Go | github.com/oxia-db/oxia | <0.16.2 | 0.16.2 |
| GO-2026-5226 | Go | github.com/oxia-db/oxia | <0.16.2 | 0.16.2 |