Threats affecting pkg:github/oxia-db/oxia

CVE-2026-40946 is a critical improper authentication vulnerability in oxia versions prior to 0.16.2. The issue arises because the OIDC authentication provider sets SkipClientIDCheck to true, disabling audience claim validation and allowing tokens intended for other services from the same OIDC issuer to be accepted by oxia. This flaw could lead to unauthorized access. The vulnerability is fixed in version 0.16.2. No known exploits are reported in the wild.

CVE-2026-40945 is a vulnerability in oxia-db's oxia metadata store and coordination system where, prior to version 0.16.2, failed OIDC authentication attempts cause the full bearer token to be logged in plaintext at DEBUG level. This exposes sensitive JWT tokens in application logs and any connected log aggregation systems if debug logging is enabled in production environments. The vulnerability has a high severity with a CVSS score of 8.7. It is fixed starting from version 0.16.2.

CVE-2026-40944 is a medium severity vulnerability in oxia versions prior to 0.16.2 where the trustedCertPool() function only parses the first PEM block from CA certificate files. This causes incomplete loading of CA bundles containing multiple certificates, breaking certificate chain validation for mutual TLS (mTLS). The issue is fixed in version 0.16.2.

CVE-2026-40943 is a race condition vulnerability in oxia, a metadata store and coordination system, affecting versions prior to 0.16.2. The issue arises from improper synchronization between session heartbeat processing and session closure, causing the server to panic due to sending on a closed channel or deadlock scenarios. This is triggered by the heartbeat() method using a blocking channel send while holding a mutex, which under certain timing conditions with concurrent close() calls leads to a time-of-check to time-of-use (TOCTOU) gap. The vulnerability has a high severity score of 8.7. A fix is available in version 0.16.2.