Neo4j CVE-2026-14587

The Bolt connector must be network-reachable; the flaw triggers at the handshake layer before any authentication, so no credentials are required. The specific condition is use of the Neo4j Bolt 'modern handshake' path, which is the default for current driver versions negotiating with affected Neo4j 5.x and 2025.x/2026.x servers. Exploitation is limited by: (1) the low-to-moderate availability impact - channels stall but the server process does not crash outright, requiring sustained flooding for measurable service degradation; (2) TCP connectivity to port 7687, which is non-routable by default in most cloud and on-premises firewall configurations; (3) no confidentiality or integrity impact, so the vulnerability cannot be leveraged for data access or modification. Environments where Bolt is intentionally internet-exposed or accessible from untrusted network segments carry the highest realistic risk.

The CVSS 4.0 score is 5.5 (Medium) with vector AV:N/AC:L/AT:N/PR:N/UI:N and a low availability impact (VA:L) confined to the vulnerable system; confidentiality and integrity are unaffected. The pre-authentication, zero-complexity network trigger (PR:N, AC:L) means any host with TCP access to port 7687 can exploit this without credentials, lowering the practical bar considerably. The E:P supplemental metric confirms a proof-of-concept exists, elevating urgency relative to unproven medium-severity findings. However, the availability impact is limited to channel exhaustion rather than crash or data loss - a sustained flood of malformed handshakes would be required to meaningfully degrade service. The vulnerability is not listed in CISA KEV, and no EPSS data was supplied; exploitation is therefore not confirmed as widespread or targeted. The primary real-world risk is a DoS scenario against Neo4j instances with Bolt exposed to untrusted networks (e.g., internet-facing or multi-tenant environments), which is a non-default but not uncommon deployment pattern.

An attacker with network access to a Neo4j Bolt port (TCP 7687) - for example, a compromised internal host or an internet-exposed Neo4j instance - sends a series of crafted Bolt modern-handshake messages each containing 32 continuation bytes in the capability mask. Each such connection stalls the server-side channel in a permanent wait state without consuming the malformed bytes, leaving open file descriptors on the server. A proof of concept exists (E:P), so scripted tooling to automate this at scale is likely straightforward, making a connection-exhaustion DoS achievable with moderate effort.