The vulnerability arises from Neo4j Enterprise Edition's Bolt modern handshake decoder treating an overlong capability bit mask the same as a truncated bit mask. When an unauthenticated client sends a selected protocol version followed by 32 continuation bytes in the capability mask, the decoder resets the reader index and waits for additional bytes instead of rejecting the message and closing the channel. This causes the same unread bytes to remain at the front of the decoder buffer, preventing recovery of the connection even if a terminating byte is appended later. The decoder repeatedly re-reads the same bytes, returns without producing a handshake-finalization message, and leaves the channel open. This can be triggered before authentication by any client able to reach the Bolt connector.

The vulnerability can cause the Bolt handshake decoder to enter a state where it indefinitely waits for more data without closing the connection, effectively causing a denial of service by leaving the channel open and unresponsive. There is no indication of privilege escalation, data disclosure, or code execution from the provided information.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary workaround is currently documented. Until a patch is available, restricting access to the Bolt connector to trusted clients only may reduce exposure.