CVE-2026-14587
Received Received - Intake

Bolt Protocol Handshake Decoder Buffer Reset Vulnerability in Neo4j

Publication date: 2026-08-05

Last updated on: 2026-08-05

Assigner: Neo4j

Description
Neo4j's Bolt modern handshake decoder treats an overlong capability bit mask the same way it treats a truncated bit mask. When an unauthenticated client sends a selected protocol version followed by 32 continuation bytes in the capability mask, the decoder resets the reader index and waits for more bytes instead of rejecting the protocol message and closing the channel. Because the same unread bytes remain at the front of the decoder buffer, appending a terminating byte later does not recover the connection. The decoder re-reads the same first 32 continuation bytes, returns without producing a handshake-finalization message, and leaves the channel open. This can be triggered before authentication by any client that can reach the Bolt connector.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-05
Last Modified
2026-08-05
Generated
2026-08-05
AI Q&A
2026-08-05
EPSS Evaluated
N/A
NVD
CVE-2026-14587
EUVD
EUVD-2026-53446

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
neo4j bolt *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-130 The product parses a formatted message or structure, but it does not handle or incorrectly handles a length field that is inconsistent with the actual length of the associated data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Neo4j's Bolt protocol has a flaw where an overlong capability bit mask is mishandled. When a client sends a specific protocol version followed by 32 extra bytes in the capability mask, the decoder incorrectly resets and waits for more data instead of rejecting the message. This leaves the connection open with unread bytes, causing repeated failed handshake attempts.

Detection Guidance

This vulnerability may be detected by monitoring for unusual network traffic patterns targeting Neo4j's Bolt protocol port. Look for connections with abnormally long capability bit masks or repeated protocol handshake attempts. Use packet inspection tools like Wireshark to analyze Bolt protocol messages for malformed handshake sequences.

Impact Analysis

An unauthenticated attacker could exploit this to disrupt Neo4j database connections by sending malformed handshake messages. This may cause denial-of-service conditions, preventing legitimate users from accessing the database.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by allowing unauthorized access to data through the Bolt protocol handshake flaw. Unauthenticated clients might exploit this to keep channels open, potentially bypassing authentication and accessing sensitive data without proper controls.

Mitigation Strategies

Immediately update Neo4j to the latest patched version that addresses this issue. If an update is not immediately available, restrict network access to the Bolt port using firewalls or disable the Bolt protocol if not required. Monitor for suspicious connection attempts and implement network-level authentication for the Bolt service.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-14587. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart