CVE-2026-40944

BRIEFING NOTE: CVE-2026-40944 Oxia versions prior to 0.16.2 contain a vulnerability in the trustedCertPool() function where TLS configuration parsing only reads the first PEM block from CA certificate files. This flaw prevents proper loading of certificate chains containing multiple certificates such as intermediate and root CAs, silently breaking mutual TLS (mTLS) certificate chain validation for systems relying on bundled CA certificates. The vulnerability poses moderate security risk with a FAUCET Risk Score of 36.0/100. While specific CVSS vector details are unavailable, the issue represents a logic flaw that silently undermines cryptographic authentication mechanisms. The attack surface depends on whether an attacker can exploit the validation bypass, though the exact attack complexity and prerequisites remain unspecified in available data. This vulnerability is not currently listed on the CISA Known Exploited Vulnerabilities catalog and shows no indicators of active exploitation in the wild. Community attention appears minimal given the low EPSS score of 0.0002, suggesting limited real-world prevalence or impact. Organizations using Oxia should upgrade to version 0.16.2 or later to restore proper certificate chain validation for mTLS connections.