CVE-2026-14587 is a high severity denial of service flaw (CVSS 7.5) in Neo4j. The Bolt handshake decoder treats an overlong capability mask like a truncated one and waits for more bytes, leaving the channel open. Neo4j recommends upgrading to 5.26.29 or 2026.07 and above.
What's affected
- Neo4j Community and Enterprise 5.0 through 5.26.29, and 2025.1.0 through 2026.07, per the Neo4j advisory.
- Fixed: the advisory recommends 5.26.29 or 2026.07 and above. It also lists those same versions as affected, which is inconsistent, so confirm the exact patched build with Neo4j.
- AuraDB is not affected.
- The trigger needs no authentication and happens before login.
Severity: the record scores this 7.5 High (vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). The Neo4j advisory page I read gives no score.
How to check if you're exposed
Find the server version and check whether the Bolt port is reachable from untrusted networks.
neo4j --version
neo4j-admin --version
Then check your listener configuration for the Bolt connector address, usually port 7687. If it is exposed to the internet or to a broad internal network, the pre-authentication nature of the flaw makes that exposure the main risk.
What to do now
- Confirm the Neo4j version and edition on every instance.
- Upgrade to the fixed build, and confirm its exact number with Neo4j given the inconsistency noted above.
- Limit the Bolt port to application hosts with firewall or network policy.
- Add connection count and idle connection alerts to the database host.
Why it matters
The record classes this as CWE-130 (Improper Handling of Length Parameter Inconsistency). The advisory says an overlong capability bit mask, 32 continuation bytes after the selected protocol version, is handled the way a truncated one would be. The decoder resets its read position and waits. Since the same unread bytes remain at the front of the buffer, adding a terminating byte later does not recover the connection, and the channel stays open.
An unauthenticated client can therefore tie up connections. Databases usually have connection limits, so enough stuck channels can crowd out legitimate clients. The lesson is to reject malformed protocol messages and close the channel. The record does not list the CVE as exploited, and it is not in CISA KEV.
Connection level denial of service is easy to miss in monitoring because CPU and memory stay quiet while connection slots fill. Track open Bolt connections and the number of connections that never complete a handshake, and alert on a sustained rise in either.
Quick check
Is authentication required?
No. The advisory says the issue can be triggered before authentication.
Is AuraDB affected?
Neo4j says it is not.
Sources
Last reviewed: 18 October 2026.
