CVE-2026-14587

Name of the Vulnerable Software and Affected Versions Neo4j (affected versions not specified)

Description An issue exists in the Bolt modern handshake decoder where an overlong capability bit mask is treated identically to a truncated bit mask. An unauthenticated client can trigger this by sending a selected protocol version followed by 32 continuation bytes in the capability mask. Instead of rejecting the message and closing the channel, the decoder resets the reader index and waits for more bytes. Since the unread bytes remain at the front of the decoder buffer, the connection cannot be recovered even if a terminating byte is appended later, as the decoder repeatedly reads the same 32 continuation bytes without producing a handshake-finalization message, leaving the channel open.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.