GHSA-5gqc-qhrj-9xw8

Source

https://github.com/advisories/GHSA-5gqc-qhrj-9xw8

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-5gqc-qhrj-9xw8/GHSA-5gqc-qhrj-9xw8.json

JSON Data

https://api.test.osv.dev/v1/vulns/GHSA-5gqc-qhrj-9xw8

Aliases

Published

2026-04-14T23:15:00Z

Modified

2026-06-25T18:56:27Z

Severity

8.7 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N CVSS Calculator

Summary

Oxia affected by server crash via race condition in session heartbeat handling

Details

Summary

A race condition between session heartbeat processing and session closure can cause the server to panic with send on closed channel. The heartbeat() method uses a blocking channel send while holding a mutex, and under specific timing with concurrent close() calls, this can lead to either a deadlock (channel buffer full) or a panic (send on closed channel after TOCTOU gap in KeepAlive).

Impact

A remote client can trigger a server crash by sending rapid KeepAlive requests while a session is expiring or being closed. This is a denial-of-service vulnerability that crashes the entire data server process.

All versions are affected.

Details

In oxiad/dataserver/controller/lead/session.go, the heartbeat() method performs a blocking s.heartbeatCh <- true send. If the channel buffer is full (size 1), this blocks while holding the session mutex, preventing close() from acquiring the lock to close the channel — a deadlock.

Additionally, in session_manager.go, KeepAlive() releases the session manager's read lock before calling heartbeat(), creating a TOCTOU window where the session can be removed and closed between the lookup and the heartbeat call.

Patches

Fixed by changing heartbeat() to use a non-blocking select with a default case, and by holding the session manager read lock through the entire KeepAlive() operation.

Workarounds

No workaround available.

Database specific

{
    "cwe_ids": [
        "CWE-362"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-04-14T23:15:00Z",
    "nvd_published_at": "2026-04-21T22:16:19Z",
    "severity": "HIGH"
}

References

Affected packages

Go / github.com/oxia-db/oxia

Package

Name: github.com/oxia-db/oxia; View open source insights on deps.dev
Purl: pkg:golang/github.com/oxia-db/oxia

Affected ranges

Type: SEMVER
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

0.16.2

Database specific

last_known_affected_version_range

"<= 0.16.1"

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-5gqc-qhrj-9xw8/GHSA-5gqc-qhrj-9xw8.json"