Executive brief
Neo4j is a graph database that uses the Bolt protocol to handle client connections. An unauthenticated attacker can send a specially crafted network packet to the Bolt connector that leaves the connection open indefinitely, preventing legitimate clients from connecting and causing a denial of service. This can be exploited before any authentication occurs, making it accessible to anyone who can reach the database server.
Technical details
A flaw exists in Neo4j's Bolt modern handshake decoder where an overlong capability bit mask is handled identically to a truncated bit mask. When an unauthenticated client sends a selected protocol version followed by 32 continuation bytes in the capability mask, the decoder resets the reader index and waits for more bytes instead of rejecting the message and closing the channel. The same unread bytes remain at the front of the decoder buffer, so appending a terminating byte later does not recover the connection; the decoder re-reads the same bytes, returns without producing a handshake-finalization message, and leaves the channel open. This pre-authentication vector is network-reachable and requires no authentication or user interaction, allowing any client with network access to the Bolt connector to trigger the condition and cause a denial of service. Patches are available in versions 5.26.29 and 2026.07 or above.
Affected products
- Neo4j Community Edition 5.0 to 5.26.28
- Neo4j Enterprise Edition 5.0 to 5.26.28, 2025.1.0 to 2026.06
Timeline
- 2026-08-05: disclosed