Unrated

UBUNTU-CVE-2026-14587

Type: withdrawalSource: OSV1 source record

Neo4j's Bolt modern handshake decoder treats an overlong capability bit mask the same way it treats a truncated bit mask. When an unauthenticated client sends a selected protocol version followed by 32 continuation bytes in the capability mask, the decoder resets the reader index and waits for more bytes instead of rejecting the protocol message and closing the channel. Because the same unread bytes remain at the front of the decoder buffer, appending a terminating byte later does not recover the connection. The decoder re-reads the same first 32 continuation bytes, returns without producing a handshake-finalization message, and leaves the channel open. This can be triggered before authentication by any client that can reach the Bolt connector.

Announced 5 Aug 2026Group revision 1

Original source ↗

UBUNTU-CVE-2026-14587

Primary source · Revision 1 · Withdrawn

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: osv:UBUNTU-CVE-2026-14587

bolt

Source reference: /affected/0/package/name

Affected versions: 0.1-0ubuntu1
Source reference: /affected/0/versions
0.2-0ubuntu1
Source reference: /affected/0/versions
0.3-0ubuntu0.1
Source reference: /affected/0/versions
0.4-0ubuntu0.18.04.1
Source reference: /affected/0/versions
0.5-0ubuntu0.18.04.1
Source reference: /affected/0/versions
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

bolt

Source reference: /affected/1/package/name

Affected versions: 0.8-4
Source reference: /affected/1/versions
0.8-4ubuntu1
Source reference: /affected/1/versions
0.9.1-2~ubuntu20.04.1
Source reference: /affected/1/versions
0.9.1-2~ubuntu20.04.2
Source reference: /affected/1/versions
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

bolt

Source reference: /affected/2/package/name

Affected versions: 0.9.1-2
Source reference: /affected/2/versions
0.9.2-1
Source reference: /affected/2/versions
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

bolt

Source reference: /affected/3/package/name

Affected versions: 0.9.5-1
Source reference: /affected/3/versions
0.9.6-1
Source reference: /affected/3/versions
0.9.6-2
Source reference: /affected/3/versions
0.9.6-2build1
Source reference: /affected/3/versions
0.9.7-1
Source reference: /affected/3/versions
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

bolt

Source reference: /affected/4/package/name

Affected versions: 0.9.8-1
Source reference: /affected/4/versions
0.9.10-1
Source reference: /affected/4/versions
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          }
        ]
      }
    ],
    "package": {
      "name": "bolt",
      "purl": "pkg:deb/ubuntu/bolt?arch=source&distro=bionic",
      "ecosystem": "Ubuntu:18.04:LTS"
    },
    "versions": [
      "0.1-0ubuntu1",
      "0.2-0ubuntu1",
      "0.3-0ubuntu0.1",
      "0.4-0ubuntu0.18.04.1",
      "0.5-0ubuntu0.18.04.1"
    ],
    "database_specific": {
      "source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-14587.json"
    },
    "ecosystem_specific": {
      "binaries": [
        {
          "binary_name": "bolt",
          "binary_version": "0.5-0ubuntu0.18.04.1"
        }
      ]
    }
  },
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          }
        ]
      }
    ],
    "package": {
      "name": "bolt",
      "purl": "pkg:deb/ubuntu/bolt?arch=source&distro=focal",
      "ecosystem": "Ubuntu:20.04:LTS"
    },
    "versions": [
      "0.8-4",
      "0.8-4ubuntu1",
      "0.9.1-2~ubuntu20.04.1",
      "0.9.1-2~ubuntu20.04.2"
    ],
    "database_specific": {
      "source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-14587.json"
    },
    "ecosystem_specific": {
      "binaries": [
        {
          "binary_name": "bolt",
          "binary_version": "0.9.1-2~ubuntu20.04.2"
        },
        {
          "binary_name": "bolt-tests",
          "binary_version": "0.9.1-2~ubuntu20.04.2"
        }
      ]
    }
  },
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          }
        ]
      }
    ],
    "package": {
      "name": "bolt",
      "purl": "pkg:deb/ubuntu/bolt?arch=source&distro=jammy",
      "ecosystem": "Ubuntu:22.04:LTS"
    },
    "versions": [
      "0.9.1-2",
      "0.9.2-1"
    ],
    "database_specific": {
      "source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-14587.json"
    },
    "ecosystem_specific": {
      "binaries": [
        {
          "binary_name": "bolt",
          "binary_version": "0.9.2-1"
        },
        {
          "binary_name": "bolt-tests",
          "binary_version": "0.9.2-1"
        }
      ]
    }
  },
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          }
        ]
      }
    ],
    "package": {
      "name": "bolt",
      "purl": "pkg:deb/ubuntu/bolt?arch=source&distro=noble",
      "ecosystem": "Ubuntu:24.04:LTS"
    },
    "versions": [
      "0.9.5-1",
      "0.9.6-1",
      "0.9.6-2",
      "0.9.6-2build1",
      "0.9.7-1"
    ],
    "database_specific": {
      "source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-14587.json"
    },
    "ecosystem_specific": {
      "binaries": [
        {
          "binary_name": "bolt",
          "binary_version": "0.9.7-1"
        },
        {
          "binary_name": "bolt-tests",
          "binary_version": "0.9.7-1"
        }
      ]
    }
  },
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          }
        ]
      }
    ],
    "package": {
      "name": "bolt",
      "purl": "pkg:deb/ubuntu/bolt?arch=source&distro=resolute",
      "ecosystem": "Ubuntu:26.04:LTS"
    },
    "versions": [
      "0.9.8-1",
      "0.9.10-1"
    ],
    "database_specific": {
      "source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-14587.json"
    },
    "ecosystem_specific": {
      "binaries": [
        {
          "binary_name": "bolt",
          "binary_version": "0.9.10-1"
        },
        {
          "binary_name": "bolt-tests",
          "binary_version": "0.9.10-1"
        }
      ]
    }
  }
]

Publisher severity

No explicit severity was provided.

Event: #36985 · Revision 1
Added to Heist Feed: Sun, 25 Oct 2026 10:05:02 GMT
Publisher date: Wed, 05 Aug 2026 17:16:00 GMT

Read the original announcement

Revision history

25 Oct 2026UBUNTU-CVE-2026-14587 · Revision 1Withdrawn