Medium severity · published Oct 31, 2025
CVE-2025-11602
Untargeted information leak in Bolt protocol handshake
6.3
CVSS
0.3%
EPSS
No
On KEV
Description
Potential information leak in bolt protocol handshake in Neo4j Enterprise and Community editions allows attacker to obtain one byte of information from previous connections. The attacker has no control over the information leaked in server responses.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 25% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CE
Community Edition · neo4j
5.26.0 before 5.26.15; 2025.1.0 before 2025.10.1 · source: vendor
EE
Enterprise Edition · neo4j
5.26.0 before 5.26.15; 2025.1.0 before 2025.10.1 · source: vendor
Affected product
CE
Community Edition
neo4j
More from Community Edition
7.5
CVE-2026-14587
Unathenticated connection can hold Bolt channel open
5.4
CVE-2026-1337
Insufficient escaping of unicode characters in query log
4.8
CVE-2026-1622
Unredacted data exposure in query.log