VulnerabilityDeferred

CVE-2025-11602

Potential information leak in bolt protocol handshake in Neo4j Enterprise and Community editions allows attacker to obtain one byte of information from previous connections.

MEDIUM 6.3EPSS 0.30%

Does this matter?

Lower severity and a low EPSS score (0.30%). Track it; it rarely justifies an emergency change on its own.

Description

Potential information leak in bolt protocol handshake in Neo4j Enterprise and Community editions allows attacker to obtain one byte of information from previous connections. The attacker has no control over the information leaked in server responses.

CVSS 4.0: 6.3 MEDIUMCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
EPSS: 0.30% probability · 23th percentile
CISA KEV: Not listed
Weakness: CWE-226
Source: 3b236295-4ccd-4a1f-a1c1-a72eecc8d7b6

References

https://neo4j.com/security/cve-2025-11602

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.