TI-2025-10632 Aliases CVE-2025-11602 GHSA-jwg7-fm78-3f3q

Untargeted information leak in Bolt protocol handshake

LOW 28CWE-226Published 2025-10-31 · Updated 2025-10-31

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Attack requirements: Present
Impact type: —
Confidentiality · integrity · availability: Low · None · None
Fix status: Partial Red Hat: 4 without a fix

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and Red Hat.

Summary

Potential information leak in bolt protocol handshake in Neo4j Enterprise and Community editions allows attacker to obtain one byte of information from previous connections. The attacker has no control over the information leaked in server responses.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00322 25th percentileScored 2026-11-07

Fix Partial Enterprise Edition (neo4j): 5.26.15, 2025.10.1Community Edition (neo4j): 5.26.15, 2025.10.1Red Hat: 4 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
neo4j	Enterprise Edition	5.26.0 to before 5.26.15; 2025.1.0 to before 2025.10.1	5.26.15, 2025.10.1	Patch available	CNA
neo4j	Community Edition	5.26.0 to before 5.26.15; 2025.1.0 to before 2025.10.1	5.26.15, 2025.10.1	Patch available	CNA

Enterprise Edition Vendorneo4j Affected 5.26.0 to before 5.26.15; 2025.1.0 to before 2025.10.1 Fixed in 5.26.15, 2025.10.1 Patch available CNA
Community Edition Vendorneo4j Affected 5.26.0 to before 5.26.15; 2025.1.0 to before 2025.10.1 Fixed in 5.26.15, 2025.10.1 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPE	Versions	Role	Vendor
cpe:2.3:a:neo4j:neo4j::::::::	—	—	neo4j

cpe:2.3:a:neo4j:neo4j:*:*:*:*:*:*:*:* Versions — — ·neo4j

Remediation

Fix · CNA Enterprise Edition (neo4j) Fixed in 5.26.15, 2025.10.1
Fix · CNA Community Edition (neo4j) Fixed in 5.26.15, 2025.10.1

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

Product	Status	Plan or fix
Red Hat Fuse 7	Affected	No fix yet: Fix deferred
Red Hat JBoss Enterprise Application Platform 8	Affected	No fix yet: Fix deferred
Red Hat JBoss Enterprise Application Platform Expansion Pack	Affected	No fix yet: Fix deferred
Red Hat OpenShift Dev Spaces	Affected	No fix yet: Fix deferred

Timeline

2026-10-02 Threatist record created from CVE-2025-11602
2026-10-03 Alias added: GHSA-jwg7-fm78-3f3q

References

Advisory 1

https://neo4j.com/security/cve-2025-11602

TI-2021-13406 Neo4j through 3.4.18 (with the shell server enabled) exposes an RMI service that… CVSS 3.1CRITICAL 9.8
TI-2026-71015 Authentication ignored for top-level @cypher fields in @neo4j/graphql CVSS 4.0CRITICAL 9.3
TI-2018-16042 neo4j-contrib neo4j-apoc-procedures version before commit 45bc09c contains a XML External… CVSS 3.0CRITICAL 10.0
TI-2018-13005 Due to incorrect access control in Neo4j Enterprise Database Server 3.4.x before 3.4.9… CVSS 3.0CRITICAL 9.8
TI-2021-18971 A directory traversal vulnerability in the apoc plugins in Neo4J Graph database before… CVSS 3.1CRITICAL 9.1
TI-2026-01049 Insufficient escaping of unicode characters in query log CVSS 4.0LOW 1.1

See all 22 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences