CVE-2025-14847Zlib compressed protocol header length confusion may allow memory read
Updated under an hour ago ()
Does this affect you?
It affects MongoDB Inc. MongoDB Server and 1 other product. Add what you run to find out whether that includes you.
CISA lists it as known exploited since Dec 29, 2025; federal agencies had to remediate by Jan 19, 2026. Treat that date as your deadline.
Do this next
Free account, 1 product
Mismatched length fields in Zlib compressed protocol headers may allow a read of uninitialized heap memory by an unauthenticated client. This issue affects all MongoDB Server v7.0 prior to 7.0.28 versions, MongoDB Server v8.0 versions prior to 8.0.17, MongoDB Server v8.2 versions prior to 8.2.3, MongoDB Server v6.0 versions prior to 6.0.27, MongoDB Server v5.0 versions prior to 5.0.32, MongoDB Server v4.4 versions prior to 4.4.30, MongoDB Server v4.2 versions greater than or equal to 4.2.0, MongoDB Server v4.0 versions greater than or equal to 4.0.0, and MongoDB Server v3.6 versions greater than or equal to 3.6.0.
- CVSS
- 7.5 HIGH (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- Weakness (CWE)
- CWE-130
- Known exploited
- Added to CISA KEV Dec 29, 2025; federal remediation due Jan 19, 2026Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- EPSS (exploitation in the next 30 days)
- 83.22% (percentile 100)
- Assigned by
- mongodb
- NVD analysis
- Analyzed
- Record last updated
- Feb 26, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
MongoDB Inc. MongoDB Server mongodb:server (from the name) | from 8.2 before 8.2.3; from 8.0 before 8.0.17; from 7.0 before 7.0.28; from 6.0 before 6.0.27; from 5.0 before 5.0.32; from 4.4 before 4.4.30; 4.2; 4.0; and 1 more ranges | CNA record |
mongodb mongodb mongodb:mongodb | from 3.6.0 before 4.4.30; from 5.0.0 before 5.0.32; from 6.0.0 before 6.0.27; from 7.0.0 before 7.0.28; from 8.0.0 before 8.0.17; from 8.2.0 before 8.2.3 | NVD |
References
- https://jira.mongodb.org/browse/SERVER-115508issue-tracking, patch, vendor-advisory
- http://www.openwall.com/lists/oss-security/2025/12/29/21mailing-list
- https://www.smartkeyss.com/post/mongobleed-pre-auth-memory-disclosure-via-op_compressed-in-mongodb-cve-2025-14847technical-description, third-party-advisory
- https://www.vicarius.io/vsociety/posts/cve-2025-14847-detection-script-heap-memory-exposure-in-mongodb-serverexploit, third-party-advisory
- https://www.vicarius.io/vsociety/posts/cve-2025-14847-mitigation-script-heap-memory-exposure-in-mongodb-serverexploit, third-party-advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-14847third-party-advisory, us-government-resource
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.