CVE-2026-40944 MEDIUM

CVE-2026-40944: Oxia: TLS CA certificate chain validation fails with multi-certificate PEM bundles

Vendor Oxia-Db
Product oxia
Weakness CWE-295
Published April 21, 2026
Last update April 22, 2026
View on NVD All CVEs

CVSS base score

6.9/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

What the vulnerability does

01Description

Oxia is a metadata store and coordination system. Prior to 0.16.2, the trustedCertPool() function in the TLS configuration only parses the first PEM block from CA certificate files. When a CA bundle contains multiple certificates (e.g., intermediate + root CA), only the first certificate is loaded. This silently breaks certificate chain validation for mTLS. This vulnerability is fixed in 0.16.2.

Key dates

02Disclosure timeline

April 21, 2026 CVE published
April 22, 2026 Record updated

Related vulnerabilities

04Related CVE

CVE-2026-4587 HybridAuth SSL Curl.php certificate validation CVE-2021-20989 Fibaro Home Center Insufficient remote access server authorization CVE-2018-5408 PrinterLogic Print Management Software fails to validate the management portal SSL certificates CVE-2023-49570 Insecure Trust of Basic Constraints certificate in Bitdefender Total Security HTTPS Scanning (VA-11210) CVE-2026-32144 OCSP designated-responder authorization bypass via missing signature verification