Is org.neo4j:neo4j affected by CVE-2026-1337?

Maven org.neo4j:neo4j is affected in <2026.01.

Is CVE-2026-1337 being exploited?

Not on the CISA KEV list. EPSS exploit probability is 0.2%.

low

CVE-2026-1337

Q: Is CVE-2026-1337 being exploited?

Not on the CISA KEV list. EPSS exploit probability is 0.2%.

Maven · org.neo4j:neo4j

Summary

Neo4j Enterprise and Community editions have insufficient escaping of unicode characters in query log

Severity: low
EPSS: 0.2% (p10)
Also known as: GHSA-xr72-g735-4vwp, BIT-neo4j-2026-1337
Published: 2026-02-06

References

https://nvd.nist.gov/vuln/detail/CVE-2026-1337
https://github.com/JoakimBulow/CVE-2026-1337
https://github.com/neo4j/neo4j

Related advisories

CVE-2026-1622 — medium · Maven/org.neo4j:neo4j

Is your project exposed to this? Stateward checks every dependency on every pull request and flags it only if your code actually reaches it.

Check my repo

Summarize with AI

ChatGPT Claude Perplexity

Sources: CISA KEV (public domain), OSV.dev & GitHub Advisory Database (CC-BY-4.0), FIRST EPSS, NVD/CWE (public domain). Served live from the Stateward advisory database.