A race condition in Oxia’s session heartbeat processing can trigger a panic when a heartbeat attempt sends on a closed channel. The flaw arises after a time‑of‑check to time‑of‑use gap in the KeepAlive logic, leading to either a deadlock or an outright panic. The resulting crash causes the metadata store and coordination system to become unavailable, effectively denying service to all clients. The vulnerability stems from improper synchronization of shared resources, identified as a classic race condition weakness (CWE‑362).

The vulnerability affects the Oxia metadata store and coordination system for all versions before 0.16.2. Updating to version 0.16.2 or later resolves the issue.

The CVSS score of 8.7 indicates a high severity impact. Although the EPSS score is not available and the vulnerability is not listed in CISA’s KEV catalog, the attack path requires an attacker to cause concurrent heartbeat and session closure activity. Based on the description, the likely attack vector involves an attacker or a compromised client that can generate traffic to trigger the race condition, but exploitation details are not fully disclosed. The overall risk remains significant due to the potential for a server crash that would disrupt services.