HIGH

CVE-2025-14847

Mongodb MongoDB 2025-12-19 CVSS v3.1

CVSS

7.5

KEV

Description

Mismatched length fields in Zlib compressed protocol headers may allow a read of uninitialized heap memory by an unauthenticated client. This issue affects all MongoDB Server v7.0 prior to 7.0.28 versions, MongoDB Server v8.0 versions prior to 8.0.17, MongoDB Server v8.2 versions prior to 8.2.3, MongoDB Server v6.0 versions prior to 6.0.27, MongoDB Server v5.0 versions prior to 5.0.32, MongoDB Server v4.4 versions prior to 4.4.30, MongoDB Server v4.2 versions greater than or equal to 4.2.0, MongoDB Server v4.0 versions greater than or equal to 4.0.0, and MongoDB Server v3.6 versions greater than or equal to 3.6.0.

Summary dbcve.org

MongoDB Server contains a vulnerability in its wire protocol handling of Zlib-compressed messages where mismatched length fields can cause the server to return uninitialized heap memory to an unauthenticated remote client, resulting in potential information disclosure.

Mitigation

Upgrade MongoDB Server to the fixed versions (v7.0.28, v8.0.17, v8.2.3, v6.0.27, v5.0.32, v4.4.30, or later) for the respective release branch.

Proof of Concept

Patch Commit

Weakness (CWE)

CWE-130

EPSS Score

83.22%

Probability of exploitation in next 30 days

99.7th percentile

References

https://jira.mongodb.org/browse/SERVER-115508 Issue Tracking, Patch, Vendor Advisory http://www.openwall.com/lists/oss-security/2025/12/29/21 Mailing List https://www.smartkeyss.com/post/mongobleed-pre-auth-memory-disclosure-via-op_compressed-in-mongodb-cve-2025-14847 Technical Description, Third Party Advisory https://www.vicarius.io/vsociety/posts/cve-2025-14847-detection-script-heap-memory-exposure-in-mongodb-server Exploit, Third Party Advisory https://www.vicarius.io/vsociety/posts/cve-2025-14847-mitigation-script-heap-memory-exposure-in-mongodb-server Exploit, Third Party Advisory https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-14847 Third Party Advisory, US Government Resource

View on dbcve.org

Base CVE data derived from NVD (public domain). Enrichment by dbcve.org (CC-BY-4.0). Fetched via API.

Back to CVE