EUVD-2026-53446
GHSA-cwvv-9488-x4h5
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable pre-auth trigger with no complexity requirements; only low availability impact (channel stall, not crash) and no confidentiality or integrity effect.
Primary rating from Vendor (Neo4j).
CVSS VectorVendor: Neo4j
Lifecycle Timeline
2DescriptionCVE.org
Neo4j's Bolt modern handshake decoder treats an overlong capability bit mask the same way it treats a truncated bit mask. When an unauthenticated client sends a selected protocol version followed by 32 continuation bytes in the capability mask, the decoder resets the reader index and waits for more bytes instead of rejecting the protocol message and closing the channel.
Because the same unread bytes remain at the front of the decoder buffer, appending a terminating byte later does not recover the connection. The decoder re-reads the same first 32 continuation bytes, returns without producing a handshake-finalization message, and leaves the channel open.
This can be triggered before authentication by any client that can reach the Bolt connector.
AnalysisAI
Bolt protocol handshake decoder in Neo4j Enterprise and Community Editions fails to distinguish overlong capability masks from truncated ones, leaving server-side channels permanently open without producing a finalization message. Any unauthenticated client reaching the Bolt connector (default TCP 7687) can trigger this pre-authentication stall by sending 32 continuation bytes in the capability mask, causing the decoder to loop on the same unread bytes. The CVSS 4.0 vector carries E:P (proof of concept exists) with a low availability impact; no active exploitation has been confirmed via CISA KEV, but the trivial pre-auth trigger and POC availability increase realistic risk to exposed Bolt endpoints.
Technical ContextAI
The Bolt protocol is Neo4j's binary client-server wire protocol, used by all official drivers and tools. The 'modern handshake' variant introduces a capability bit mask exchanged during the initial negotiation phase before any authentication occurs. CWE-130 (Improper Handling of Length Parameter Inconsistency) is the root cause: the decoder applies the same code path to a mask that is overlong as it does to one that is truncated, resetting the Netty reader index and returning in a 'wait for more data' state rather than rejecting the malformed message. Because the unread continuation bytes remain at the front of the decoder buffer, any subsequent write to the channel causes re-reading of the same 32-byte sequence, permanently stalling the handshake state machine and leaving the TCP channel open. Affected CPEs are cpe:2.3:a:neo4j:enterprise_edition and cpe:2.3:a:neo4j:community_edition across the 5.x and 2025.x/2026.x release trains.
RemediationAI
Upgrade to Neo4j Enterprise Edition 2026.07 or later, or to Neo4j Enterprise/Community Edition 5.26.29 or later, per the vendor advisory at https://neo4j.com/security/CVE-2026-14587. Patch is confirmed available from Neo4j. If immediate patching is not feasible, restrict network access to the Bolt connector (TCP 7687) using firewall rules or network ACLs to trusted clients and application-layer hosts only - this directly limits the attack surface since the flaw requires reaching the Bolt endpoint. Disabling the Bolt connector entirely is a more aggressive mitigation if only the HTTP/HTTPS API is required, but note that all official Neo4j drivers depend on Bolt, so this trade-off will break driver-based application connectivity. Rate-limiting inbound Bolt connections at the network edge can reduce the availability impact of a sustained malformed-handshake flood while patching is scheduled.
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today