CVE-2025-11602: NEO4J Community Edition

Medium severity, CVSS 6.3. EPSS: 0.3% chance of exploitation in the next 30 days.

Potential information leak in bolt protocol handshake in Neo4j Enterprise and Community editions allows attacker to obtain one byte of information from previous connections. The attacker has no control over the information leaked in server responses.

Affected products

• NEO4J Community Edition: from 5.26.0, before 5.26.15 (fixed in 5.26.15); from 2025.1.0, before 2025.10.1 (fixed in 2025.10.1)
• NEO4J Enterprise Edition: from 5.26.0, before 5.26.15 (fixed in 5.26.15); from 2025.1.0, before 2025.10.1 (fixed in 2025.10.1)

Published 2025-10-31. Last modified 2026-06-17.