CVE-2025-11602: Neo4j Information Disclosure Vulnerability

CVE-2025-11602 Overview

CVE-2025-11602 is an information disclosure vulnerability in the Bolt protocol handshake implementation of Neo4j Enterprise and Community editions. During the handshake process, the server can return one byte of residual data from previous connections. An unauthenticated remote attacker can trigger this behavior by initiating Bolt protocol connections. The attacker has no control over which byte of information is leaked in server responses, limiting exploitation to opportunistic data collection. The issue is classified under [CWE-226] Sensitive Information in Resource Not Removed Before Reuse.

Critical Impact
Unauthenticated network attackers can obtain a single byte of residual data from previous Bolt protocol connections, potentially exposing fragments of sensitive information across sessions.

Affected Products

Neo4j Enterprise Edition
Neo4j Community Edition
Neo4j deployments exposing the Bolt protocol endpoint

Discovery Timeline

2025-10-31 - CVE-2025-11602 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-11602

Vulnerability Analysis

The vulnerability resides in the Bolt protocol handshake logic used by Neo4j to negotiate client-server communication. Bolt is a stateful, binary protocol that Neo4j uses for driver connections to the database. During the handshake exchange, the server fails to fully clear or reinitialize a buffer region before sending a response to a new client.

As a result, one byte of data from a prior connection persists in the outgoing handshake response. This residual byte becomes visible to any client that completes the initial Bolt negotiation. Because the leak is limited to a single, uncontrolled byte, direct extraction of complete secrets is not feasible in a single request.

Repeated connection attempts across time could allow an attacker to accumulate fragments of memory contents. The severity is constrained by the lack of attacker control over what data is exposed and the small volume per request.

Root Cause

The root cause is improper resource cleanup between connection sessions. Memory or buffer state associated with a completed Bolt handshake is not zeroed or reset before servicing a new client request. This maps to [CWE-226], where sensitive information remains in a reusable resource.

Attack Vector

Exploitation requires only network access to the Bolt protocol listener, which defaults to TCP port 7687. No authentication or user interaction is needed to trigger the leak. An attacker initiates a Bolt handshake and observes the response bytes returned by the server. Reference: Neo4j CVE-2025-11602 Advisory.

The vulnerability manifests during the protocol version negotiation phase of the handshake. See the vendor advisory for technical specifics on the affected byte position and connection flow.

Detection Methods for CVE-2025-11602

Indicators of Compromise

Elevated volumes of short-lived Bolt protocol connections to TCP port 7687 from single or clustered source IP addresses
Repeated Bolt handshake requests that terminate immediately after receiving the initial server response without proceeding to authentication
Connection patterns from non-application sources or unexpected geolocations targeting the Bolt endpoint

Detection Strategies

Monitor Neo4j debug.log and query logs for abnormal patterns of aborted handshake sessions
Deploy network intrusion detection signatures for repetitive Bolt protocol negotiation traffic without follow-up authentication
Correlate database connection telemetry with source reputation and rate thresholds to flag reconnaissance behavior

Monitoring Recommendations

Enable verbose connection logging on Neo4j servers to capture Bolt handshake source addresses and timestamps
Establish baselines for legitimate Bolt client connection rates and alert on statistical deviations
Ingest Neo4j and network flow logs into a centralized analytics platform for cross-source correlation

How to Mitigate CVE-2025-11602

Immediate Actions Required

Upgrade Neo4j Enterprise and Community editions to the fixed versions listed in the Neo4j CVE-2025-11602 Advisory
Restrict network exposure of the Bolt port 7687 to trusted application subnets using firewall rules or security groups
Audit external accessibility of Neo4j instances and remove public internet exposure where not required

Patch Information

Neo4j has published guidance and fixed builds in the vendor advisory. Refer to the Neo4j CVE-2025-11602 Advisory for the specific patched versions of Enterprise and Community editions and upgrade instructions.

Workarounds

Place Neo4j behind a network segment that requires VPN or bastion access before reaching the Bolt endpoint
Enforce TLS for Bolt connections and restrict client certificates to known application services
Apply strict ingress access control lists limiting Bolt connectivity to authorized application server IP ranges

bash

# Example firewall configuration restricting Bolt port 7687 to an application subnet
iptables -A INPUT -p tcp --dport 7687 -s 10.20.30.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 7687 -j DROP