EUVD-2026-24498
GHSA-5gqc-qhrj-9xw8
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable and unauthenticated (AV:N/PR:N) but requires winning a timing-dependent race, so AC:H; impact is process crash only, hence C:N/I:N/A:H.
Primary rating from GitHub Advisory.
CVSS VectorGitHub Advisory
Lifecycle Timeline
4DescriptionGitHub Advisory
Oxia is a metadata store and coordination system. Prior to 0.16.2, a race condition between session heartbeat processing and session closure can cause the server to panic with send on closed channel. The heartbeat() method uses a blocking channel send while holding a mutex, and under specific timing with concurrent close() calls, this can lead to either a deadlock (channel buffer full) or a panic (send on closed channel after TOCTOU gap in KeepAlive). This vulnerability is fixed in 0.16.2.
AnalysisAI
Denial-of-service in Oxia (metadata store and coordination system) versions <= 0.16.1 allows a remote unauthenticated client to crash the entire data server process by racing rapid KeepAlive/heartbeat requests against session expiry or closure. The flaw is a concurrency bug (send on closed channel panic, or deadlock when the buffer fills) triggerable without authentication over the network. No public exploit identified at time of analysis; EPSS is low (0.04%) and CISA SSVC rates exploitation as none, but the low attack complexity makes it a credible availability threat once patched.
Technical ContextAI
Oxia is a Go-based distributed metadata store and coordination service (the go/github.com/oxia-db/oxia module). The root cause is CWE-362 (Race Condition / concurrent execution using shared resource with improper synchronization). In oxiad/dataserver/controller/lead/session.go, the heartbeat() method performs a blocking channel send (s.heartbeatCh <- true) while holding the session mutex; with a buffer size of 1, a full buffer blocks the goroutine while it still holds the lock, preventing close() from acquiring it (deadlock). Separately, session_manager.go releases the session manager's read lock before invoking heartbeat(), opening a time-of-check-to-time-of-use (TOCTOU) window in KeepAlive() during which the session can be removed and its channel closed - a subsequent send then panics with 'send on closed channel', terminating the process.
RemediationAI
Vendor-released patch: 0.16.2 - upgrade the Oxia data server to 0.16.2 or later, which changes heartbeat() to a non-blocking select with a default case and holds the session manager read lock through the entire KeepAlive() operation, eliminating both the deadlock and the TOCTOU send-on-closed-channel panic. The vendor states no workaround is available, so patching is the only complete fix; as an interim compensating control, restrict network access to the Oxia data server's client/KeepAlive endpoint to trusted coordination peers and clients (e.g. via network policy, firewall, or mTLS-authenticated ingress) to limit who can send rapid KeepAlive traffic - trade-off is that this does not prevent an authorized-but-malicious or buggy client from triggering the race and adds network-configuration overhead. Full details are in the advisory at https://github.com/oxia-db/oxia/security/advisories/GHSA-5gqc-qhrj-9xw8.
Authentication bypass in Oxia (oxia-db) metadata store and coordination system prior to 0.16.2 allows an attacker holdin
Sensitive information disclosure in Oxia (a metadata store and coordination system) prior to 0.16.2 causes the full OIDC
Incomplete PEM parsing in Oxia's TLS subsystem silently drops all but the first certificate from CA bundle files, breaki
Same weakness CWE-362 – Race Condition
View allSame technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Important| Product | Status |
|---|---|
| SUSE Linux Enterprise Server 16.1 | Affected |
| SUSE Linux Enterprise Server for SAP applications 16.1 | Affected |
| SUSE Linux Enterprise Module for Package Hub 15 SP5 | Affected |
| SUSE Linux Enterprise Module for Package Hub 15 SP6 | Affected |
| openSUSE Leap 15.5 | Affected |
| openSUSE Leap 15.6 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today