GHSA-7jrq-q4pq-rhm6: Oxia's TLS CA certificate chain validation fails with multi-certificate PEM bundles

April 14, 2026

The trustedCertPool() function in the TLS configuration only parses the first PEM block from CA certificate files. When a CA bundle contains multiple certificates (e.g., intermediate + root CA), only the first certificate is loaded. This silently breaks certificate chain validation for mTLS.

References

github.com/advisories/GHSA-7jrq-q4pq-rhm6
github.com/oxia-db/oxia
github.com/oxia-db/oxia/security/advisories/GHSA-7jrq-q4pq-rhm6

Code Behaviors & Features

Detect and mitigate GHSA-7jrq-q4pq-rhm6 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →