CVE-2026-14587

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-14587
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-14587.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-14587
Downstream
Published
2026-08-05T16:10:47.327Z
Modified
2026-08-09T08:32:47.527877Z
Severity
  • 5.5 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P CVSS Calculator
Summary
Unathenticated connection can hold Bolt channel open
Details

Neo4j's Bolt modern handshake decoder treats an overlong capability bit mask the same way it treats a truncated bit mask. When an unauthenticated client sends a selected protocol version followed by 32 continuation bytes in the capability mask, the decoder resets the reader index and waits for more bytes instead of rejecting the protocol message and closing the channel.

Because the same unread bytes remain at the front of the decoder buffer, appending a terminating byte later does not recover the connection. The decoder re-reads the same first 32 continuation bytes, returns without producing a handshake-finalization message, and leaves the channel open.

This can be triggered before authentication by any client that can reach the Bolt connector.

Database specific 
{
    "cna_assigner": "Neo4j",
    "cwe_ids": [
        "CWE-130"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/14xxx/CVE-2026-14587.json"
}
References

Affected packages

Git / github.com/neo4j/neo4j

Affected ranges

Type
GIT
Repo
https://github.com/neo4j/neo4j
Events
Introduced
aa168a96c066c736faaf121480c2b5572ad0037d
Fixed
1575d24cb402dcd48b36836a4542bbc1b40726cc
Introduced
a2691a8124cb50ac64087c3406a00d25d1f11ca5
Fixed
e1d373ea096b22961d1b944d9aaa85f999764c02
Database specific 
{
    "source": "AFFECTED_FIELD",
    "extracted_events": [
        {
            "introduced": "2025.01"
        },
        {
            "fixed": "2026.07"
        },
        {
            "introduced": "5.0"
        },
        {
            "fixed": "5.26.29"
        }
    ]
}

Affected versions

1.*
1.0.0
5.*
5.0.0
5.1.0
5.2.0
5.26.14
5.26.18
5.26.20
5.26.21
5.26.24
5.26.25
5.26.26
5.26.27
5.26.28

Database specific

vanir_signatures_modified 
"2026-08-09T08:32:47Z"
vanir_signatures 
[
    {
        "target": {
            "file": "community/server/src/main/java/org/neo4j/server/queryapi/metrics/QueryAPIMetricsFilter.java"
        },
        "digest": {
            "line_hashes": [
                "281397860072625815177979118177535146615",
                "16385064975575997674529754850643982128",
                "278098883028726819934211519186929922922",
                "332794863214587791687666185482003160409",
                "326410652119254881612681818324305130697",
                "91038505645837940590671849496465736869",
                "240679780399304399810772710218409410323",
                "5395474414999655588366809634463917015"
            ],
            "threshold": 0.9
        },
        "signature_version": "v1",
        "signature_type": "Line",
        "deprecated": false,
        "id": "CVE-2026-14587-00ff3e89",
        "source": "https://github.com/neo4j/neo4j/commit/e1d373ea096b22961d1b944d9aaa85f999764c02"
    },
    {
        "target": {
            "file": "community/community-it/query-api-it/src/test/java/org/neo4j/queryapi/tx/QueryResourceTxIT.java"
        },
        "digest": {
            "line_hashes": [
                "107549041477127340119720822573802303402",
                "142968067325199888556459747910970435524",
                "337195675238063223889278832691585771182",
                "163413227905172956432913009148885038921"
            ],
            "threshold": 0.9
        },
        "signature_version": "v1",
        "signature_type": "Line",
        "deprecated": false,
        "id": "CVE-2026-14587-268fbbdd",
        "source": "https://github.com/neo4j/neo4j/commit/e1d373ea096b22961d1b944d9aaa85f999764c02"
    },
    {
        "target": {
            "function": "start",
            "file": "community/server/src/main/java/org/neo4j/server/modules/QueryModule.java"
        },
        "digest": {
            "length": 203.0,
            "function_hash": "24752142780380074938736265977694463896"
        },
        "signature_version": "v1",
        "signature_type": "Function",
        "deprecated": false,
        "id": "CVE-2026-14587-6e2e6703",
        "source": "https://github.com/neo4j/neo4j/commit/e1d373ea096b22961d1b944d9aaa85f999764c02"
    },
    {
        "target": {
            "function": "shouldHaveExpectedTransactionIdLength",
            "file": "community/community-it/query-api-it/src/test/java/org/neo4j/queryapi/tx/QueryResourceTxIT.java"
        },
        "digest": {
            "length": 322.0,
            "function_hash": "85171114009987797118674370065075744798"
        },
        "signature_version": "v1",
        "signature_type": "Function",
        "deprecated": false,
        "id": "CVE-2026-14587-7a4d9b74",
        "source": "https://github.com/neo4j/neo4j/commit/e1d373ea096b22961d1b944d9aaa85f999764c02"
    },
    {
        "target": {
            "function": "QueryAPIMetricsFilter",
            "file": "community/server/src/main/java/org/neo4j/server/queryapi/metrics/QueryAPIMetricsFilter.java"
        },
        "digest": {
            "length": 262.0,
            "function_hash": "315259626021353211897580046471912499140"
        },
        "signature_version": "v1",
        "signature_type": "Function",
        "deprecated": false,
        "id": "CVE-2026-14587-b25b1555",
        "source": "https://github.com/neo4j/neo4j/commit/e1d373ea096b22961d1b944d9aaa85f999764c02"
    },
    {
        "target": {
            "file": "community/server/src/main/java/org/neo4j/server/modules/QueryModule.java"
        },
        "digest": {
            "line_hashes": [
                "267236073087947314394912872811153367170",
                "74481396489149117548776923825240062666",
                "106668076014491685213610966971109330203",
                "124549342378881676405995685954954347000"
            ],
            "threshold": 0.9
        },
        "signature_version": "v1",
        "signature_type": "Line",
        "deprecated": false,
        "id": "CVE-2026-14587-bddb828f",
        "source": "https://github.com/neo4j/neo4j/commit/e1d373ea096b22961d1b944d9aaa85f999764c02"
    },
    {
        "target": {
            "file": "community/server/src/main/java/org/neo4j/server/configuration/ServerSettings.java"
        },
        "digest": {
            "line_hashes": [
                "301147552656041680223775647075490507028",
                "72833812808631486460107891377084203183",
                "42782416822430420108127032849970982221",
                "201962134915724934713184519947323188710"
            ],
            "threshold": 0.9
        },
        "signature_version": "v1",
        "signature_type": "Line",
        "deprecated": false,
        "id": "CVE-2026-14587-e816b12a",
        "source": "https://github.com/neo4j/neo4j/commit/e1d373ea096b22961d1b944d9aaa85f999764c02"
    }
]
source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-14587.json"