Vulnerability in Neo4j Community Edition
CVE-2026-14587
Neo4j's Bolt modern handshake decoder treats an overlong capability bit mask the same way it treats a truncated bit mask. When an unauthenticated client sends a selected protocol version followed by 32 continuation bytes in the capability…
Affected products
- Neo4j Community Edition — versions 2025.01, 5.0
- Neo4j Enterprise Edition — versions 2025.01, 5.0
Weakness classification (CWE)
References
- 3b236295-4ccd-4a1f-a1c1-a72eecc8d7b6 (vendor-advisory)