CVE-2026-40943
HighSummary
Oxia prior to 0.16.2 has a race condition between session heartbeat processing and session closure that can cause the server to panic with send on closed channel. The heartbeat() method uses a blocking channel send while holding a mutex, and under specific timing with concurrent close() calls, this can lead to deadlock or panic.
Risk Assessment
The risk includes server crash (panic) or deadlock, potentially leading to service unavailability and system downtime.
Recommendation
Upgrade Oxia to version 0.16.2, which contains the fix. Also monitor server stability and consider implementing automatic restart mechanisms.
Other vulnerabilities in Oxia
See all- CVE-2026-40945High
Oxia prior to 0.16.2 logs the full bearer token in plaintext at DEBUG level when OIDC authentication fails. If debug logging is enabled in production, JWT tokens are exposed in application logs and any connected log aggregation system.
- CVE-2026-40946Critical
In Oxia before 0.16.2, the OIDC authentication provider sets SkipClientIDCheck to true, disabling the aud claim validation. This allows tokens issued for other services by the same OIDC issuer to be accepted.
Original NVD description (English source)
Oxia is a metadata store and coordination system. Prior to 0.16.2, a race condition between session heartbeat processing and session closure can cause the server to panic with send on closed channel. The heartbeat() method uses a blocking channel send while holding a mutex, and under specific timing with concurrent close() calls, this can lead to either a deadlock (channel buffer full) or a panic (send on closed channel after TOCTOU gap in KeepAlive). This vulnerability is fixed in 0.16.2.