Security Advisory

CVE-2026-40944

CVE vulnerability detail — eXtreme Datacenter Security Operations

Published 2026-04-21 21:14:56

Last updated 2026-04-22 13:18:32

Assigner GitHub_M

State PUBLISHED

Description

Oxia is a metadata store and coordination system. Prior to 0.16.2, the trustedCertPool() function in the TLS configuration only parses the first PEM block from CA certificate files. When a CA bundle contains multiple certificates (e.g., intermediate + root CA), only the first certificate is loaded. This silently breaks certificate chain validation for mTLS. This vulnerability is fixed in 0.16.2.

← Browse all CVEs View on cve.org ↗