Vulnerability in Neo4j Bolt Handshake Decoder affecting Data Integration
CVE-2026-14587

5.5MEDIUM

Key Information:

Vendor

Neo4j

Status
Enterprise Edition
Community Edition
Vendor
CVE Published:
5 August 2026

What is CVE-2026-14587?

A vulnerability exists in the way Neo4j's Bolt protocol handles the handshake process. The Bolt modern handshake decoder improperly processes an overlong capability bit mask, treating it similarly to a truncated one. This flaw permits an unauthenticated client to transmit a selected protocol version followed by excessive bytes, which leads to the decoder not rejecting the message as it should. Instead of closing the channel, it resets the reader index and awaits further input. As a consequence, the channel remains open without finalizing the handshake, exposing the system to potential unauthorized interactions.

Affected Version(s)

Community Edition 2025.01 < 2026.07

Community Edition 5.0 < 5.26.29

Enterprise Edition 2025.01 < 2026.07

References

https://neo4j.com/security/CVE-2026-14587
vendor-advisory

CVSS V4

Score:
5.5
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

liyi.zhou@sydney.edu.au (Liyi), https://lzhou1110.github.io/
ziyue0530@gmail.com (Ziyue), https://zyy0530.github.io/
cshe0476@uni.sydney.edu.au (Strick), https://str1ckl4nd.github.io/
chng0012@uni.sydney.edu.au (Maurice), http://maurice.busystar.org/
cyu210608@gmail.com (Chenchen), https://7thparkk.github.io/
.