CVE-2025-14847
CVE-2025-14847 is a high-severity vulnerability in Mongodb with a CVSS 3.x base score of 7.5. It is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog, confirming it has been exploited in the wild (added 2025-12-29). The underlying weakness is classified as CWE-130.
Key facts
- Severity: High (CVSS 3.x base score 7.5)
- CVSS v4: 8.7
- EPSS exploit prediction: 83% (100th percentile)
- Actively exploited: Yes — listed in CISA KEV (added 2025-12-29)
- EU (EUVD) id: EUVD-2025-204529
- EU exploitation: Flagged exploited in the ENISA EU Vulnerability Database (since 2025-12-29)
- Weakness: CWE-130
- Affected product: Mongodb
- Published:
- Last modified:
Description
Mismatched length fields in Zlib compressed protocol headers may allow a read of uninitialized heap memory by an unauthenticated client. This issue affects all MongoDB Server v7.0 prior to 7.0.28 versions, MongoDB Server v8.0 versions prior to 8.0.17, MongoDB Server v8.2 versions prior to 8.2.3, MongoDB Server v6.0 versions prior to 6.0.27, MongoDB Server v5.0 versions prior to 5.0.32, MongoDB Server v4.4 versions prior to 4.4.30, MongoDB Server v4.2 versions greater than or equal to 4.2.0, MongoDB Server v4.0 versions greater than or equal to 4.0.0, and MongoDB Server v3.6 versions greater than or equal to 3.6.0.
Frequently asked questions
- What is CVE-2025-14847?
- Mismatched length fields in Zlib compressed protocol headers may allow a read of uninitialized heap memory by an unauthenticated client. This issue affects all MongoDB Server v7.0 prior to 7.0.28 versions, MongoDB Server v8.0 versions prior to 8.0.17, MongoDB Server v8.2 versions prior to 8.2.3, MongoDB Server v6.0 versions prior to 6.0.27, MongoDB Server v5.0 versions prior to 5.0.32, MongoDB Server v4.4 versions prior to 4.4.30, MongoDB Server v4.2 versions greater than or equal to 4.2.0, MongoDB Server v4.0 versions greater than or equal to 4.0.0, and MongoDB Server v3.6 versions greater than or equal to 3.6.0.
- How severe is CVE-2025-14847?
- CVE-2025-14847 has a CVSS 3.x base score of 7.5, rated high severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity none, and availability none.
- Is CVE-2025-14847 being actively exploited?
- Yes. CVE-2025-14847 is on CISA's Known Exploited Vulnerabilities (KEV) catalog, added on 2025-12-29, which means active exploitation has been confirmed. It should be prioritised for remediation.
- What products are affected by CVE-2025-14847?
- CVE-2025-14847 primarily affects Mongodb. In total, 2 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
- How do I fix CVE-2025-14847?
- Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Because this CVE is known to be actively exploited, treat remediation as urgent — CISA KEV typically sets a short remediation deadline.
- Does CVE-2025-14847 have an EU (EUVD) identifier?
- Yes. CVE-2025-14847 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2025-204529. It is also flagged as exploited in the EUVD (since 2025-12-29).
- When was CVE-2025-14847 published?
- CVE-2025-14847 was published on 2025-12-19 and last updated on 2026-06-17.
References
- https://jira.mongodb.org/browse/SERVER-115508
- http://www.openwall.com/lists/oss-security/2025/12/29/21
- https://www.smartkeyss.com/post/mongobleed-pre-auth-memory-disclosure-via-op_compressed-in-mongodb-cve-2025-14847
- https://www.vicarius.io/vsociety/posts/cve-2025-14847-detection-script-heap-memory-exposure-in-mongodb-server
- https://www.vicarius.io/vsociety/posts/cve-2025-14847-mitigation-script-heap-memory-exposure-in-mongodb-server
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-14847
Affected products (2)
- cpe:2.3:a:mongodb:mongodb:*:*:*:*:*:*:*:*
- cpe:2.3:a:mongodb:mongodb:*:*:*:*:-:*:*:*
More vulnerabilities in Mongodb
- CVE-2017-15535 — Critical (CVSS 9.1): MongoDB 3.4.x before 3.4.10, and 3.5.x-development, has a disabled-by-default configuration setting,…
- CVE-2026-11933 — High (CVSS 8.8): A use-after-free vulnerability exists in MongoDB Server's server-side JavaScript engine when converting BSON documents…
- CVE-2026-8053 — High (CVSS 8.8): An issue in MongoDB Server's time-series collection implementation allows an authenticated user with database write…
- CVE-2026-4148 — High (CVSS 8.8): A use-after-free vulnerability can be triggered in sharded clusters by an authenticated user with the read role who…
- CVE-2024-1351 — High (CVSS 8.8): Under certain configurations of --tlsCAFile and tls.CAFile, MongoDB Server may skip peer certificate validation which…
- CVE-2025-0755 — High (CVSS 8.4): The various bson_append functions in the MongoDB C driver library may be susceptible to buffer overflow when…
Other CWE-130 vulnerabilities
- CVE-2022-2714 — Critical (CVSS 9.8): Improper Handling of Length Parameter Inconsistency in GitHub repository francoisjacquet/rosariosis prior to 10.0.
- CVE-2026-9054 — Critical (CVSS 9.2): An attacker sending tcp, il, rudp, rudp, or gre packets with a length less than the header size would trigger a kernel…
- CVE-2022-1543 — High (CVSS 8.8): Improper handling of Length parameter in GitHub repository erudika/scoold prior to 1.49.4. When the text size is large…
- CVE-2026-3868 — High (CVSS 8.7): An improper handling of the length parameter inconsistency vulnerability has been identified in Moxa’s Secure…
- CVE-2026-5367 — High (CVSS 8.6): A flaw was found in OVN (Open Virtual Network). A remote attacker, by sending crafted DHCPv6 (Dynamic Host…
- CVE-2022-20870 — High (CVSS 8.6): A vulnerability in the egress MPLS packet processing function of Cisco IOS XE Software for Cisco Catalyst 3650,…
Browse all CWE-130 vulnerabilities →
Threat intelligence
Threat-intel indicators referencing this CVE:
- 1.234.27.159 (ipv4-addr)
- 103.7.41.117 (ipv4-addr)
- 165.232.118.73 (ipv4-addr)
- 167.71.60.5 (ipv4-addr)