# CVE-2026-40944: Oxia's TLS CA certificate chain validation fails with multi-certificate PEM bundles

Source: https://junglewise.ai/threats/cve-2026-40944-oxia-s-tls-ca-certificate-chain-validation-fails-with-multi  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-14. Updated: 2026-05-11  
License: CC BY 4.0 with a link back

CVE-2026-40944 · Severity: high · CVSS 4 · Published 2026-04-14

### Summary
The `trustedCertPool()` function in the TLS configuration only parses the first PEM block from CA certificate files. When a CA bundle contains multiple certificates (e.g., intermediate + root CA), only the first certificate is loaded. This silently breaks certificate chain validation for mTLS.

### Impact
In deployments using mTLS with certificate chains (intermediate CA + root CA bundles), legitimate clients with properly chained certificates are rejected with `x509: certificate signed by unknown authority`. This degrades the security posture by making mTLS unusable with standard CA chain configurations, potentially forcing operators to disable client certificate verification.

All versions using TLS with `trustedCaFile` configuration are affected.

### Details
In `common/security/tls.go`, the `trustedCertPool()` method calls `pem.Decode()` only once, processing a single PEM block. The remaining bytes (containing additional certificates) are silently discarded. Additionally, the error return from `pem.Decode` is ignored, so a corrupted CA file results in an empty certificate pool without any error.

### Patches
Fixed by iterating over all PEM blocks in the file, parsing each CERTIFICATE block, and returning an error if no valid certificates are found.

### Workarounds
Use CA files containing only a single certificate (the direct issuer of client certificates, not a chain).

Technologies: [github.com/oxia-db/oxia (Go)](https://junglewise.ai/threats/technologies/github-com-oxia-db-oxia). Vendors: [Go](https://junglewise.ai/threats/vendors/go).

## Quick answers

**Is CVE-2026-40944 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-40944 being exploited in the wild.

**How severe is CVE-2026-40944?** High severity, with a CVSS score of 4, published 14 April 2026.

**Which products and versions are affected?** github.com/oxia-db/oxia (Go) <= 0.16.1, SEMVER:introduced=0,fixed=0.16.2.

**Is there a fix for CVE-2026-40944?** Yes. github.com/oxia-db/oxia (Go): upgrade to 0.16.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**Am I affected by CVE-2026-40944?** Check whether you run github.com/oxia-db/oxia (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- github.com/oxia-db/oxia (Go): upgrade to 0.16.2 or later

  ```sh
  go get github.com/oxia-db/oxia@v0.16.2
  ```


## Affected products

- github.com/oxia-db/oxia (Go) <= 0.16.1, SEMVER:introduced=0,fixed=0.16.2

## Identifiers

- CVE-2026-40944
- GHSA-7jrq-q4pq-rhm6
- GO-2026-5226

## References

- [https://github.com/oxia-db/oxia/security/advisories/GHSA-7jrq-q4pq-rhm6](https://github.com/oxia-db/oxia/security/advisories/GHSA-7jrq-q4pq-rhm6)
- [https://api.github.com/repos/oxia-db/oxia/security-advisories/GHSA-7jrq-q4pq-rhm6](https://api.github.com/repos/oxia-db/oxia/security-advisories/GHSA-7jrq-q4pq-rhm6)

## Related threats

- [Oxia affected by server crash via race condition in session heartbeat handling](https://junglewise.ai/threats/cve-2026-40943-oxia-affected-by-server-crash-via-race-condition-in-session)
- [Oxia has an OIDC token audience validation bypass via SkipClientIDCheck](https://junglewise.ai/threats/cve-2026-40946-oxia-has-an-oidc-token-audience-validation-bypass-via)
- [Oxia exposes bearer token in debug log messages on authentication failure](https://junglewise.ai/threats/cve-2026-40945-oxia-exposes-bearer-token-in-debug-log-messages-on-authentication)