Unathenticated connection can hold Bolt channel open
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- —
- Confidentiality · integrity · availability
- None · None · Low
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA.
Summary
Neo4j's Bolt modern handshake decoder treats an overlong capability bit mask the same way it treats a truncated bit mask. When an unauthenticated client sends a selected protocol version followed by 32 continuation bytes in the capability mask, the decoder resets the reader index and waits for more bytes instead of rejecting the protocol message and closing the channel. Because the same unread bytes remain at the front of the decoder buffer, appending a terminating byte later does not recover the connection. The decoder re-reads the same first 32 continuation bytes, returns without producing a handshake-finalization message, and leaves the channel open. This can be triggered before authentication by any client that can reach the Bolt connector.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| neo4j | Enterprise Edition | 2025.01 to before 2026.07; 5.0 to before 5.26.29 | 2026.07, 5.26.29 | Patch available | CNA |
| neo4j | Community Edition | 2025.01 to before 2026.07; 5.0 to before 5.26.29 | 2026.07, 5.26.29 | Patch available | CNA |
- Enterprise Edition Vendorneo4j Affected 2025.01 to before 2026.07; 5.0 to before 5.26.29 Fixed in 2026.07, 5.26.29 Patch available CNA
- Community Edition Vendorneo4j Affected 2025.01 to before 2026.07; 5.0 to before 5.26.29 Fixed in 2026.07, 5.26.29 Patch available CNA
CPE configurations NVD · 4
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:neo4j:neo4j:*:*:*:*:community:*:*:* | 5.0.0 to before 5.26.29 | Vulnerable | neo4j |
| cpe:2.3:a:neo4j:neo4j:*:*:*:*:enterprise:*:*:* | 5.0.0 to before 5.26.29 | Vulnerable | neo4j |
| cpe:2.3:a:neo4j:neo4j:*:*:*:*:community:*:*:* | 2025.01.0 to before 2026.07.0 | Vulnerable | neo4j |
| cpe:2.3:a:neo4j:neo4j:*:*:*:*:enterprise:*:*:* | 2025.01.0 to before 2026.07.0 | Vulnerable | neo4j |
- cpe:2.3:a:neo4j:neo4j:*:*:*:*:community:*:*:* Versions 5.0.0 to before 5.26.29 Vulnerable ·neo4j
- cpe:2.3:a:neo4j:neo4j:*:*:*:*:enterprise:*:*:* Versions 5.0.0 to before 5.26.29 Vulnerable ·neo4j
- cpe:2.3:a:neo4j:neo4j:*:*:*:*:community:*:*:* Versions 2025.01.0 to before 2026.07.0 Vulnerable ·neo4j
- cpe:2.3:a:neo4j:neo4j:*:*:*:*:enterprise:*:*:* Versions 2025.01.0 to before 2026.07.0 Vulnerable ·neo4j
Remediation
- Fix · CNA Enterprise Edition (neo4j) Fixed in 2026.07, 5.26.29
- Fix · CNA Community Edition (neo4j) Fixed in 2026.07, 5.26.29
Timeline
- 2026-10-02 Threatist record created from CVE-2026-14587
- 2026-10-03 Alias added: GHSA-cwvv-9488-x4h5
References
More Neo4j vulnerabilities
- TI-2021-13406 Neo4j through 3.4.18 (with the shell server enabled) exposes an RMI service that… CVSS 3.1CRITICAL 9.8
- TI-2018-13005 Due to incorrect access control in Neo4j Enterprise Database Server 3.4.x before 3.4.9… CVSS 3.0CRITICAL 9.8
- TI-2026-01049 Insufficient escaping of unicode characters in query log CVSS 4.0LOW 1.1
- TI-2013-05927 Multiple cross-site request forgery (CSRF) vulnerabilities in Neo4J 1.9.2 allow remote… CVSS 2.0MEDIUM 6.8
- TI-2024-22827 Improper privilege management in Neo4j CVSS 3.1MEDIUM 6.5
- TI-2026-01192 Incorrect privilege assignment in composite databases CVSS 4.0LOW 2.0
Sources
- CVE-2026-14587 · CVE Program
- CVE-2026-14587 · NVD
- FIRST EPSS
- GHSA-cwvv-9488-x4h5 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences