CVE-2026-40943 Details
Description
Oxia is a metadata store and coordination system. Prior to 0.16.2, a race condition between session heartbeat processing and session closure can cause the server to panic with send on closed channel. The heartbeat() method uses a blocking channel send while holding a mutex, and under specific timing with concurrent close() calls, this can lead to either a deadlock (channel buffer full) or a panic (send on closed channel after TOCTOU gap in KeepAlive). This vulnerability is fixed in 0.16.2.
A denial-of-service vulnerability has been identified in Oxia, a metadata store and coordination system, in versions prior to 0.16.2. The issue arises from a race condition between the processing of session heartbeat signals and the closure of sessions, which can cause the server to crash with a 'send on closed channel' error. This vulnerability allows a remote client to trigger a server panic by sending rapid 'KeepAlive' requests while a session is being closed or is expiring. The problem is rooted in the 'heartbeat()' method, which uses a blocking channel send while holding a mutex. Under certain timing conditions with concurrent 'close()' calls, this can result in either a deadlock, when the channel buffer is full, or a panic, due to sending on a closed channel after a time-of-check-to-time-of-use gap in the 'KeepAlive' process.
Users can upgrade to Oxia version 0.16.2 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Apr 21, 2026CISA-ADP
Assessed Apr 22, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/oxia-db/oxia/security/advisories/GHSA-5gqc-qhrj-9xw8 | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-362 | Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Oxia | All versions |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 21, 2026 | New CVE Received | [email protected] |