CVE-2026-40943

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-40943", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-04-15T20:40:15.519Z", "datePublished": "2026-04-21T21:13:31.675Z", "dateUpdated": "2026-04-22T13:55:27.811Z"}, "containers": {"cna": {"title": "Oxia: Server crash via race condition in session heartbeat handling", "problemTypes": [{"descriptions": [{"cweId": "CWE-362", "lang": "en", "description": "CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 8.7, "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "version": "4.0"}}], "references": [{"name": "https://github.com/oxia-db/oxia/security/advisories/GHSA-5gqc-qhrj-9xw8", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/oxia-db/oxia/security/advisories/GHSA-5gqc-qhrj-9xw8"}], "affected": [{"vendor": "oxia-db", "product": "oxia", "versions": [{"version": "< 0.16.2", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-04-21T21:13:31.675Z"}, "descriptions": [{"lang": "en", "value": "Oxia is a metadata store and coordination system. Prior to 0.16.2, a race condition between session heartbeat processing and session closure can cause the server to panic with send on closed channel. The heartbeat() method uses a blocking channel send while holding a mutex, and under specific timing with concurrent close() calls, this can lead to either a deadlock (channel buffer full) or a panic (send on closed channel after TOCTOU gap in KeepAlive). This vulnerability is fixed in 0.16.2."}], "source": {"advisory": "GHSA-5gqc-qhrj-9xw8", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-22T13:54:53.719939Z", "id": "CVE-2026-40943", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-22T13:55:27.811Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-40943", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-22T13:54:53.719939Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-22T13:55:17.103Z"}}], "cna": {"title": "Oxia: Server crash via race condition in session heartbeat handling", "source": {"advisory": "GHSA-5gqc-qhrj-9xw8", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 8.7, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE"}}], "affected": [{"vendor": "oxia-db", "product": "oxia", "versions": [{"status": "affected", "version": "< 0.16.2"}]}], "references": [{"url": "https://github.com/oxia-db/oxia/security/advisories/GHSA-5gqc-qhrj-9xw8", "name": "https://github.com/oxia-db/oxia/security/advisories/GHSA-5gqc-qhrj-9xw8", "tags": ["x_refsource_CONFIRM"]}], "descriptions": [{"lang": "en", "value": "Oxia is a metadata store and coordination system. Prior to 0.16.2, a race condition between session heartbeat processing and session closure can cause the server to panic with send on closed channel. The heartbeat() method uses a blocking channel send while holding a mutex, and under specific timing with concurrent close() calls, this can lead to either a deadlock (channel buffer full) or a panic (send on closed channel after TOCTOU gap in KeepAlive). This vulnerability is fixed in 0.16.2."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-362", "description": "CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-04-21T21:13:31.675Z"}}}, "cveMetadata": {"cveId": "CVE-2026-40943", "state": "PUBLISHED", "dateUpdated": "2026-04-22T13:55:27.811Z", "dateReserved": "2026-04-15T20:40:15.519Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-04-21T21:13:31.675Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "oxia", "vendor": "oxia-db", "versions": [{"status": "affected", "version": "< 0.16.2"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Oxia is a metadata store and coordination system. Prior to 0.16.2, a race condition between session heartbeat processing and session closure can cause the server to panic with send on closed channel. The heartbeat() method uses a blocking channel send while holding a mutex, and under specific timing with concurrent close() calls, this can lead to either a deadlock (channel buffer full) or a panic (send on closed channel after TOCTOU gap in KeepAlive). This vulnerability is fixed in 0.16.2."}], "id": "CVE-2026-40943", "lastModified": "2026-06-17T10:45:55.210", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 8.7, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-40943", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-04-22T13:54:53.719939Z", "version": "2.0.3"}}]}, "published": "2026-04-21T22:16:19.847", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/oxia-db/oxia/security/advisories/GHSA-5gqc-qhrj-9xw8"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-362"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,0.16.2)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "oxia", "source": "cna", "vendor": "oxia-db"}, "product": "oxia", "vendor": "oxia-db"}], "analysis": {"en": {"generated_at": "2026-04-22T07:07:58.380787+00:00", "value": {"mitigation_remediation": ["Upgrade Oxia to version 0.16.2 or later.", "Limit access to the Oxia service to trusted clients and consider implementing authentication or rate limiting to reduce potential traffic that could trigger the race condition.", "Configure a process supervisor or watchdog to automatically restart the Oxia server if it crashes, and enable log monitoring for panic events to alert administrators promptly."], "summary": {"action": "Apply Patch", "impact": "Server Crash (Denial of Service)"}, "threat_synthesis": {"affected_systems": "The vulnerability affects the Oxia metadata store and coordination system for all versions before 0.16.2. Updating to version 0.16.2 or later resolves the issue.", "description_and_impact": "A race condition in Oxia\u2019s session heartbeat processing can trigger a panic when a heartbeat attempt sends on a closed channel. The flaw arises after a time\u2011of\u2011check to time\u2011of\u2011use gap in the KeepAlive logic, leading to either a deadlock or an outright panic. The resulting crash causes the metadata store and coordination system to become unavailable, effectively denying service to all clients. The vulnerability stems from improper synchronization of shared resources, identified as a classic race condition weakness (CWE\u2011362).", "risk_and_exploitability": "The CVSS score of 8.7 indicates a high severity impact. Although the EPSS score is not available and the vulnerability is not listed in CISA\u2019s KEV catalog, the attack path requires an attacker to cause concurrent heartbeat and session closure activity. Based on the description, the likely attack vector involves an attacker or a compromised client that can generate traffic to trigger the race condition, but exploitation details are not fully disclosed. The overall risk remains significant due to the potential for a server crash that would disrupt services."}}}}, "created": "2026-04-22T07:15:11.668507+00:00", "updated": "2026-04-22T11:45:00.416969+00:00", "vendors": ["oxia-db", "oxia-db$PRODUCT$oxia"]}