Approved changes feed: RSS · Atom
cpe:2.3:a:oxia-db:oxia:*:*:*:*:*:*:*:*part: a version: * update: *
| Vendor | Oxia Db (020a993b-81a8-55c0-9007-87f24bf11159) |
|---|---|
| Product | Oxia (25afb49e-73dc-5b2a-8683-c373760463c5) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from gcve-enriched-dumps CVE data
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-40946 |
vulnerable | 2026-06-08 08:03:14.478463 |
Oxia: OIDC token audience validation bypass via SkipClientIDCheck
Oxia is a metadata store and coordination system. Prior to 0.16.2, the OIDC authentication provider unconditionally sets SkipClientIDCheck: true in the go-oidc verifier configuration, disabling the standard audience (aud) claim validation at the library level. This allows tokens issued for unrelated services by the same OIDC issuer to be accepted by Oxia. This vulnerability is fixed in 0.16.2.
Published: 2026-04-21T21:18:12.103Z
Updated: 2026-04-22T18:11:23.671Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-40945 |
vulnerable | 2026-06-08 08:03:14.477975 |
Oxia: Bearer token exposed in debug log messages on authentication failure
Oxia is a metadata store and coordination system. Prior to 0.16.2, when OIDC authentication fails, the full bearer token is logged at DEBUG level in plaintext. If debug logging is enabled in production, JWT tokens are exposed in application logs and any connected log aggregation system. This vulnerability is fixed in 0.16.2.
Published: 2026-04-21T21:16:28.138Z
Updated: 2026-04-22T17:44:37.673Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-40944 |
vulnerable | 2026-06-08 08:03:14.477539 |
Oxia: TLS CA certificate chain validation fails with multi-certificate PEM bundles
Oxia is a metadata store and coordination system. Prior to 0.16.2, the trustedCertPool() function in the TLS configuration only parses the first PEM block from CA certificate files. When a CA bundle contains multiple certificates (e.g., intermediate + root CA), only the first certificate is loaded. This silently breaks certificate chain validation for mTLS. This vulnerability is fixed in 0.16.2.
Published: 2026-04-21T21:14:56.814Z
Updated: 2026-04-22T13:18:32.925Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-40943 |
vulnerable | 2026-06-08 08:03:14.477059 |
Oxia: Server crash via race condition in session heartbeat handling
Oxia is a metadata store and coordination system. Prior to 0.16.2, a race condition between session heartbeat processing and session closure can cause the server to panic with send on closed channel. The heartbeat() method uses a blocking channel send while holding a mutex, and under specific timing with concurrent close() calls, this can lead to either a deadlock (channel buffer full) or a panic (send on closed channel after TOCTOU gap in KeepAlive). This vulnerability is fixed in 0.16.2.
Published: 2026-04-21T21:13:31.675Z
Updated: 2026-04-22T13:55:27.811Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.