# CVE-2026-40943: Oxia affected by server crash via race condition in session heartbeat handling

Source: https://junglewise.ai/threats/cve-2026-40943-oxia-affected-by-server-crash-via-race-condition-in-session  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-14. Updated: 2026-05-11  
License: CC BY 4.0 with a link back

CVE-2026-40943 · Severity: high · CVSS 4 · Published 2026-04-14

### Summary
A race condition between session heartbeat processing and session closure can cause the server to panic with `send on closed channel`. The `heartbeat()` method uses a blocking channel send while holding a mutex, and under specific timing with concurrent `close()` calls, this can lead to either a deadlock (channel buffer full) or a panic (send on closed channel after TOCTOU gap in `KeepAlive`).

### Impact
A remote client can trigger a server crash by sending rapid `KeepAlive` requests while a session is expiring or being closed. This is a denial-of-service vulnerability that crashes the entire data server process.

All versions are affected.

### Details
In `oxiad/dataserver/controller/lead/session.go`, the `heartbeat()` method performs a blocking `s.heartbeatCh <- true` send. If the channel buffer is full (size 1), this blocks while holding the session mutex, preventing `close()` from acquiring the lock to close the channel — a deadlock.

Additionally, in `session_manager.go`, `KeepAlive()` releases the session manager's read lock before calling `heartbeat()`, creating a TOCTOU window where the session can be removed and closed between the lookup and the heartbeat call.

### Patches
Fixed by changing `heartbeat()` to use a non-blocking `select` with a `default` case, and by holding the session manager read lock through the entire `KeepAlive()` operation.

### Workarounds
No workaround available.

Technologies: [github.com/oxia-db/oxia (Go)](https://junglewise.ai/threats/technologies/github-com-oxia-db-oxia). Vendors: [Go](https://junglewise.ai/threats/vendors/go).

## Quick answers

**Is CVE-2026-40943 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-40943 being exploited in the wild.

**How severe is CVE-2026-40943?** High severity, with a CVSS score of 4, published 14 April 2026.

**Which products and versions are affected?** github.com/oxia-db/oxia (Go) <= 0.16.1, SEMVER:introduced=0,fixed=0.16.2.

**Is there a fix for CVE-2026-40943?** Yes. github.com/oxia-db/oxia (Go): upgrade to 0.16.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**Am I affected by CVE-2026-40943?** Check whether you run github.com/oxia-db/oxia (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- github.com/oxia-db/oxia (Go): upgrade to 0.16.2 or later

  ```sh
  go get github.com/oxia-db/oxia@v0.16.2
  ```


## Affected products

- github.com/oxia-db/oxia (Go) <= 0.16.1, SEMVER:introduced=0,fixed=0.16.2

## Identifiers

- CVE-2026-40943
- GHSA-5gqc-qhrj-9xw8
- GO-2026-5145

## References

- [https://github.com/oxia-db/oxia/security/advisories/GHSA-5gqc-qhrj-9xw8](https://github.com/oxia-db/oxia/security/advisories/GHSA-5gqc-qhrj-9xw8)
- [https://api.github.com/repos/oxia-db/oxia/security-advisories/GHSA-5gqc-qhrj-9xw8](https://api.github.com/repos/oxia-db/oxia/security-advisories/GHSA-5gqc-qhrj-9xw8)

## Related threats

- [Oxia's TLS CA certificate chain validation fails with multi-certificate PEM bundles](https://junglewise.ai/threats/cve-2026-40944-oxia-s-tls-ca-certificate-chain-validation-fails-with-multi)
- [Oxia has an OIDC token audience validation bypass via SkipClientIDCheck](https://junglewise.ai/threats/cve-2026-40946-oxia-has-an-oidc-token-audience-validation-bypass-via)
- [Oxia exposes bearer token in debug log messages on authentication failure](https://junglewise.ai/threats/cve-2026-40945-oxia-exposes-bearer-token-in-debug-log-messages-on-authentication)