Description
Mismatched length fields in Zlib compressed protocol headers may allow a read of uninitialized heap memory by an unauthenticated client. This issue affects all MongoDB Server v7.0 prior to 7.0.28 versions, MongoDB Server v8.0 versions prior to 8.0.17, MongoDB Server v8.2 versions prior to 8.2.3, MongoDB Server v6.0 versions prior to 6.0.27, MongoDB Server v5.0 versions prior to 5.0.32, MongoDB Server v4.4 versions prior to 4.4.30, MongoDB Server v4.2 versions greater than or equal to 4.2.0, MongoDB Server v4.0 versions greater than or equal to 4.0.0, and MongoDB Server v3.6 versions greater than or equal to 3.6.0.
Metrics
CVSS 3.1 7.5/10
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NWeakness enumeration
Affected software
| Vendor | Product | Versions |
|---|---|---|
| MongoDB Inc. | MongoDB Server | >= 8.2, < 8.2.3; >= 8.0, < 8.0.17; >= 7.0, < 7.0.28; >= 6.0, < 6.0.27; >= 5.0, < 5.0.32; >= 4.4, < 4.4.30; 4.2; 4.0; 3.6 |
References
- https://jira.mongodb.org/browse/SERVER-115508Issue Tracking, Patch, Vendor Advisory
- http://www.openwall.com/lists/oss-security/2025/12/29/21Mailing List
- https://www.smartkeyss.com/post/mongobleed-pre-auth-memory-disclosure-via-op_compressed-in-mongodb-cve-2025-14847Technical Description, Third Party Advisory
- https://www.vicarius.io/vsociety/posts/cve-2025-14847-detection-script-heap-memory-exposure-in-mongodb-serverExploit, Third Party Advisory
- https://www.vicarius.io/vsociety/posts/cve-2025-14847-mitigation-script-heap-memory-exposure-in-mongodb-serverExploit, Third Party Advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-14847Third Party Advisory, US Government Resource
Timeline
- Published
- Dec 19, 2025
- Last modified
- Jun 17, 2026
- Added to CISA KEV
- Dec 29, 2025
- NVD status
- Analyzed