CVE-2025-11602: Untargeted information leak in Bolt protocol handshake

Severity: medium (CVSS 6.3 v4.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-10-31 · updated 2026-10-18
Weakness: CWE-226

Description

Potential information leak in bolt protocol handshake in Neo4j Enterprise and Community editions allows attacker to obtain one byte of information from previous connections. The attacker has no control over the information leaked in server responses.

Affected products

neo4j Community Edition: from 5.26.0 before 5.26.15; from 2025.1.0 before 2025.10.1 — fixed in 2025.10.1, 5.26.15
neo4j Enterprise Edition: from 5.26.0 before 5.26.15; from 2025.1.0 before 2025.10.1 — fixed in 2025.10.1, 5.26.15

How to fix

Upgrade to a fixed version: neo4j Community Edition 2025.10.1, 5.26.15; neo4j Enterprise Edition 2025.10.1, 5.26.15. Check the vendor advisory for mitigations.

References

https://neo4j.com/security/cve-2025-11602

Get alerted when CVE-2025-11602 or the next vulnerability affects your stack