PT-2026-34188 · Oxia · Oxia

CVE-2026-40944 · Published 2026-04-14 · Updated 2026-07-30

Positive Technologies (AI Summary)

CVSS v4.0

8.0

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U

Name of the Vulnerable Software and Affected Versions Oxia versions prior to 0.16.2

Description The trustedCertPool() function in the TLS configuration only parses the first PEM block from CA certificate files. When a CA bundle contains multiple certificates, such as an intermediate and a root CA, only the first certificate is loaded, which silently breaks certificate chain validation for mutual TLS (mTLS), a process where both the client and server authenticate each other using certificates.

Recommendations Update to version 0.16.2.

Exploit

Fix

Improper Certificate Validation

Weakness Enumeration

CWE-295

Related Identifiers

CVE-2026-40944

GHSA-7JRQ-Q4PQ-RHM6

GO-2026-5226

OPENSUSE-SU-2026:21483-1

Affected Products

Oxia

References · 1743

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/40xxx/CVE-2026-40944.json · Exploit
• https://osv.dev/vulnerability/CVE-2026-40944 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-40944 · Security Note
• https://osv.dev/vulnerability/GO-2026-5226 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-7jrq-q4pq-rhm6 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:21483-1 · Vendor Advisory
• https://github.com/oxia-db/oxia/security/advisories/GHSA-7jrq-q4pq-rhm6 · Note
• https://github.com/oxia-db/oxia · Note
• https://suse.com/security/cve/CVE-2025-65797 · Note
• https://suse.com/security/cve/CVE-2026-44427 · Note
• https://suse.com/security/cve/CVE-2026-27589 · Note
• https://suse.com/security/cve/CVE-2026-7736 · Note
• https://suse.com/security/cve/CVE-2026-27137 · Note
• https://suse.com/security/cve/CVE-2026-25232 · Note
• https://suse.com/security/cve/CVE-2026-55513 · Note