Home

Description

Potential information leak in bolt protocol handshake in Neo4j Enterprise and Community editions allows attacker to obtain one byte of information from previous connections. The attacker has no control over the information leaked in server responses.

PUBLISHED Reserved 2025-10-10 | Published 2025-10-31 | Updated 2025-10-31 | Assigner Neo4j




MEDIUM: 6.3CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/V:D/U:Clear

Problem types

CWE-226: Sensitive Information in Resource Not Removed Before Reuse

Product status

Default status
unaffected

5.26.0 (semver) before 5.26.15
affected

2025.1.0 (semver) before 2025.10.1
affected

Default status
unaffected

5.26.0 (semver) before 5.26.15
affected

2025.1.0 (semver) before 2025.10.1
affected

References

neo4j.com/security/cve-2025-11602 vendor-advisory

cve.org (CVE-2025-11602)

nvd.nist.gov (CVE-2025-11602)

Download JSON