UBUNTU-CVE-2026-14587

Neo4j's Bolt modern handshake decoder treats an overlong capability bit mask the same way it treats a truncated bit mask. When an unauthenticated client sends a selected protocol version followed by 32 continuation bytes in the capability mask, the decoder resets the reader index and waits for mo...

CVE-2026-14587

Neo4j Bolt handshake decoder mishandles an overlong capability bitmask: when an unauthenticated client sends a protocol version followed by 32 continuation bytes, the decoder resets its reader index and waits for more data instead of rejecting the message and closing the channel, leaving the conn...