CVE-2026-40943: falha de alta gravidade em oxia-db oxia
Oxia: Server crash via race condition in session heartbeat handling
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 8.7epss 0.2%
Oxia is a metadata store and coordination system. Prior to 0.16.2, a race condition between session heartbeat processing and session closure can cause the server to panic with send on closed channel. The heartbeat() method uses a blocking channel send while holding a mutex, and under specific timing with concurrent close() calls, this can lead to either a deadlock (channel buffer full) or a panic (send on closed channel after TOCTOU gap in KeepAlive). This vulnerability is fixed in 0.16.2.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Produtos afetados
oxia-db · oxiaCVEs relacionadas — oxia-db oxia
No mesmo produto, das mais perigosas para as menos.
CVE-2026-40945HIGHOxia: Bearer token exposed in debug log messages on authentication failureEPSS 0.3%CVE-2026-40946CRITICALOxia: OIDC token audience validation bypass via SkipClientIDCheckEPSS 0.3%CVE-2026-40944MEDIUMOxia: TLS CA certificate chain validation fails with multi-certificate PEM bundlesEPSS 0.2%