Neo4j’s Bolt protocol handshake decoder fails to reject an overlong capability bit mask; instead it resets its parser and awaits further bytes. An unauthenticated client can send a selected protocol version followed by 32 bytes of capability data, causing the decoder to loop back over the same data and never emit a handshake‑finalization message. The Bolt channel therefore remains open indefinitely, consuming server resources until the connection is manually closed or the server times out. The vulnerability is an input validation flaw (CWE‑130) that can lead to resource exhaustion or partial denial of service. Based on the description, it is inferred that the attacker does not need any authentication or privileged access to trigger the issue.

The flaw is present in Neo4j Community Edition and Neo4j Enterprise Edition. No specific version information is supplied, so any affected release that has not applied the vendor’s fix is at risk. The attacker only needs network reachability to the Bolt connector used by Neo4j.

The CVSS score of 5.5 indicates moderate severity. EPSS data is not available, and the vulnerability is not listed in CISA’s KEV catalog, implying limited public exploitation. The likely attack vector is an unauthenticated client that can reach the Bolt port; no special privileges or credentials are required. Exploitation would require the attacker to maintain a persistent connection to the vulnerable service, which may be mitigated by network segmentation or application‑layer timeouts. Overall the risk is moderate but should be addressed promptly to prevent potential DoS.