The vulnerability stems from the trustedCertPool() function in Oxia, which, in versions prior to 0.16.2, only parses the first PEM block of a CA certificate file. When a certificate bundle contains multiple PEM blocks—such as an intermediate and a root certificate—the additional certificates are ignored, causing certificate chain validation to silently fail. This flaw is a certificate validation weakness (CWE-295) that can lead to the failure of mutual TLS authentication for legitimate connections, effectively disabling a critical security mechanism and resulting in a loss of availability for services that rely on mTLS.

Oxia, a metadata store and coordination system developed by oxia-db, is affected in all releases before version 0.16.2. The vulnerability arises from the TLS configuration when multi‑certificate PEM bundles are used.

The CVSS score of 6.9 indicates a high‑moderate severity, and the exploit probability is not available, though the vulnerability is not listed in the CISA KEV catalog. An attacker could exploit this flaw via remote network traffic by presenting a multi‑certificate PEM bundle to an Oxia instance; the server would silently reject the chain, causing denial‑of‑service conditions for mutual TLS‑protected endpoints. There is no code execution vector or direct elevation of privileges reported. The risk is primarily associated with availability and authentication failure rather than confidentiality or integrity.