CVE-2026-40943: Oxia-DB Oxia

High severity, CVSS 8.7. EPSS: 0.3% chance of exploitation in the next 30 days.

Oxia is a metadata store and coordination system. Prior to 0.16.2, a race condition between session heartbeat processing and session closure can cause the server to panic with send on closed channel. The heartbeat() method uses a blocking channel send while holding a mutex, and under specific timing with concurrent close() calls, this can lead to either a deadlock (channel buffer full) or a panic (send on closed channel after TOCTOU gap in KeepAlive). This vulnerability is fixed in 0.16.2.

Affected products

• Oxia-DB Oxia: before 0.16.2 (fixed in 0.16.2)

Published 2026-04-21. Last modified 2026-06-17.