CVE-2025-11602

Potential information leak in bolt protocol handshake in Neo4j Enterprise and Community editions allows attacker to obtain one byte of information from previous connections. The attacker has no control over the information leaked in server responses.

CVSS

No CVSS.

References

Link	Resource
https://neo4j.com/security/cve-2025-11602

Configurations

No configuration.

History

18 Oct 2026, 21:10

Type	Values Removed	Values Added
Summary		(es) Posible fuga de información en el handshake del protocolo bolt en las ediciones Neo4j Enterprise y Community permite al atacante obtener un byte de información de conexiones anteriores. El atacante no tiene control sobre la información filtrada en las respuestas del servidor.

Information

Published : 2025-10-31 11:15

Updated : 2026-10-18 21:10

NVD link : CVE-2025-11602

Mitre link : CVE-2025-11602

CVE.ORG link : CVE-2025-11602

JSON object : View

Products Affected

No product.

CWE

CWE-226

Sensitive Information in Resource Not Removed Before Reuse

{"id": "CVE-2025-11602", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-11602", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-10-31T11:36:06.456339Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "3b236295-4ccd-4a1f-a1c1-a72eecc8d7b6", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 6.3, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "DIFFUSE", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:D/RE:X/U:Clear", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "CLEAR", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "3b236295-4ccd-4a1f-a1c1-a72eecc8d7b6", "affectedData": [{"vendor": "neo4j", "product": "Enterprise Edition", "versions": [{"status": "affected", "version": "5.26.0", "lessThan": "5.26.15", "versionType": "semver"}, {"status": "affected", "version": "2025.1.0", "lessThan": "2025.10.1", "versionType": "semver"}], "defaultStatus": "unaffected"}, {"repo": "https://github.com/neo4j/neo4j", "vendor": "neo4j", "product": "Community Edition", "versions": [{"status": "affected", "version": "5.26.0", "lessThan": "5.26.15", "versionType": "semver"}, {"status": "affected", "version": "2025.1.0", "lessThan": "2025.10.1", "versionType": "semver"}], "packageName": "neo4j", "collectionURL": "https://mvnrepository.com/artifact/org.neo4j/", "defaultStatus": "unaffected"}]}], "published": "2025-10-31T11:15:33.513", "references": [{"url": "https://neo4j.com/security/cve-2025-11602", "source": "3b236295-4ccd-4a1f-a1c1-a72eecc8d7b6"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "3b236295-4ccd-4a1f-a1c1-a72eecc8d7b6", "description": [{"lang": "en", "value": "CWE-226"}]}], "descriptions": [{"lang": "en", "value": "Potential information leak in bolt protocol handshake in Neo4j Enterprise and Community editions allows attacker to obtain one byte of information from previous connections. The attacker has no control over the information leaked in server responses."}, {"lang": "es", "value": "Posible fuga de informaci\u00f3n en el handshake del protocolo bolt en las ediciones Neo4j Enterprise y Community permite al atacante obtener un byte de informaci\u00f3n de conexiones anteriores. El atacante no tiene control sobre la informaci\u00f3n filtrada en las respuestas del servidor."}], "lastModified": "2026-10-18T21:10:00.120", "sourceIdentifier": "3b236295-4ccd-4a1f-a1c1-a72eecc8d7b6"}