CVE-2026-40943

OVERVIEW CVE-2026-40943 affects Oxia, a metadata store and coordination system, in versions prior to 0.16.2. The vulnerability is a race condition occurring between session heartbeat processing and session closure that causes the server to panic when attempting to send data on a closed channel. The issue stems from improper synchronization in the heartbeat() method, which uses blocking channel operations while holding a mutex, creating a time-of-check-time-of-use (TOCTOU) gap in the KeepAlive mechanism. SEVERITY The vulnerability carries a FAUCET Risk Score of 42.0/100, indicating moderate severity. The attack vector and complexity details are not specified in available documentation. The potential impact includes server denial of service through panics or deadlocks, which could disrupt the availability of the metadata store and coordination services that depend on Oxia. The low EPSS score of 0.000380 suggests this vulnerability presents minimal practical exploitation risk relative to other disclosed vulnerabilities. EXPLOITATION STATUS There is currently no evidence of active exploitation, with the vulnerability marked as inactive on exploit tracking lists. The CVE does not appear on the Known Exploited Vulnerabilities (KEV) catalog, and no public exploit code has been identified. Community attention has been limited, though the vulnerability was formally addressed in version 0.16.2, making patching the appropriate mitigation strategy for affected deployments.