CVE-2025-11602

MEDIUM

Untargeted information leak in Bolt protocol handshake

Title source: CVE List
STIX 2.1 vulnerability

Record summary

CVE-2025-11602 has a selected CVSS score of 6.3 (medium).

Description

Potential information leak in bolt protocol handshake in Neo4j Enterprise and Community editions allows attacker to obtain one byte of information from previous connections. The attacker has no control over the information leaked in server responses.

Description source: CVE List

Exploitation context

CISA SSVC decision

ExploitationNone
AutomatableNo
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated Oct 31, 2025 · Source: CVE List

Affected products and versions

2
ProductSourceVersion range

Community Edition

Browse neo4j / Community Editionneo4j

Default status: unaffected

CVE List5.26.0 to < 5.26.15affected
2025.1.0 to < 2025.10.1affected

Enterprise Edition

Browse neo4j / Enterprise Edition

Default status: unaffected

CVE List5.26.0 to < 5.26.15affected
2025.1.0 to < 2025.10.1affected

References

2