{"id":"CVE-2025-14847","kind":"vulnerability","aliases":["CVE-2025-14847"],"related":[],"title":"mongodb: Mismatched length fields in Zlib compressed protocol headers may allow a read of uninitialized heap memory by an…","description":"Mismatched length fields in Zlib compressed protocol headers may allow a read of uninitialized heap memory by an unauthenticated client. This issue affects all MongoDB Server v7.0 prior to 7.0.28 versions, MongoDB Server v8.0 versions prior to 8.0.17, MongoDB Server v8.2 versions prior to 8.2.3, MongoDB Server v6.0 versions prior to 6.0.27, MongoDB Server v5.0 versions prior to 5.0.32, MongoDB Server v4.4 versions prior to 4.4.30, MongoDB Server v4.2 versions greater than or equal to 4.2.0, MongoDB Server v4.0 versions greater than or equal to 4.0.0, and MongoDB Server v3.6 versions greater than or equal to 3.6.0.","summary":"MongoDB Server mishandles a length field in Zlib-compressed protocol headers, so a remote client can make it read uninitialized heap memory. An unauthenticated attacker can leak whatever sits in server memory, which may include credentials or data from other operations.","severity":"high","cvss":8.7,"epss":null,"exploited":true,"exploited_at":"2025-12-29T00:00:00+00:00","products":[{"name":"MongoDB MongoDB and MongoDB Server","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"mongodb","fixed":["4.4.30"],"affected":">= 3.6.0, < 4.4.30","ecosystem":"vendor"},{"name":"mongodb","fixed":["5.0.32"],"affected":">= 5.0.0, < 5.0.32","ecosystem":"vendor"},{"name":"mongodb","fixed":["6.0.27"],"affected":">= 6.0.0, < 6.0.27","ecosystem":"vendor"},{"name":"mongodb","fixed":["7.0.28"],"affected":">= 7.0.0, < 7.0.28","ecosystem":"vendor"},{"name":"mongodb","fixed":["8.0.17"],"affected":">= 8.0.0, < 8.0.17","ecosystem":"vendor"},{"name":"mongodb","fixed":["8.2.3"],"affected":">= 8.2.0, < 8.2.3","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["database","exploited","infrastructure","mongodb","poc-public","self-hosted"],"not_affected_if":["managed-hosting","zlib-compression-disabled"],"how_to_check":"Check the MongoDB server version against the vendor advisory (unknown from sources which versions are affected).\nCheck whether zlib wire protocol compression is enabled (networkMessageCompressors includes zlib) and whether port 27017 is reachable from untrusted networks.","fix":"Upgrade MongoDB Server to a patched release listed in the vendor advisory (unknown from sources which version).\nUntil patched, disable zlib compression on the server and restrict network access to MongoDB ports.","status":"open","published_at":"2025-12-19T11:15:49+00:00","first_seen_at":"2026-10-23T19:11:51+00:00","triaged_at":"2026-10-23T20:42:40+00:00","updated_at":"2026-10-23T23:44:51+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-23T20:42:40Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade MongoDB Server to a patched release listed in the vendor advisory (unknown from sources which version).\nUntil patched, disable zlib compression on the server and restrict network access to MongoDB ports.","reach":"network","summary":"MongoDB Server mishandles a length field in Zlib-compressed protocol headers, so a remote client can make it read uninitialized heap memory. An unauthenticated attacker can leak whatever sits in server memory, which may include credentials or data from other operations.","category":"infrastructure","who_cares":["mongodb","self-hosted","database"],"confidence":0.6,"needs_auth":"no","worst_case":"Unauthenticated attacker reads server heap memory, possibly leaking secrets or data.","analyst_note":"Confirm affected and fixed versions and the zlib-only condition from the MongoDB security advisory for CVE-2025-14847; check the public PoC scope and the CISA KEV due date.","how_to_check":"Check the MongoDB server version against the vendor advisory (unknown from sources which versions are affected).\nCheck whether zlib wire protocol compression is enabled (networkMessageCompressors includes zlib) and whether port 27017 is reachable from untrusted networks.\nunknown for exact affected version ranges.","needs_analyst":true,"not_affected_if":["managed-hosting","zlib-compression-disabled"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000519,"input_tokens":2623,"output_tokens":513,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-14847':20A,23A '-2025':19A,22A '3.6.0':183C '4.0.0':172C '4.2.0':162C '4.4.30':152C '5.0.32':145C '6.0.27':138C '7.0.28':116C '8.0.17':124C '8.2.3':131C 'affect':109C 'allow':11A,96C 'and':26A 'attack':70B 'client':60B,106C 'compress':7A,54B,92C 'credenti':81B 'cve':18A,21A 'data':83B 'databas':35B 'equal':160C,170C,181C 'exploit':36B 'field':4A,50B,89C 'greater':157C,167C,178C 'header':9A,56B,94C 'heap':16A,66B,101C 'host':44B 'includ':80B 'infrastructur':37B 'issu':108C 'leak':72B 'length':3A,49B,88C 'make':62B 'may':10A,79B,95C 'memori':17A,67B,77B,102C 'mishandl':47B 'mismatch':2A,87C 'mongodb':1A,24A,25A,27A,29A,30A,31A,32A,33A,34A,38B,45B,111C,118C,125C,132C,139C,146C,153C,163C,174C 'oper':86B 'poc':40B 'poc-publ':39B 'prior':114C,122C,129C,136C,143C,150C 'protocol':8A,55B,93C 'public':41B 'read':13A,64B,98C 'remot':59B 'self':43B 'self-host':42B 'server':28A,46B,76B,112C,119C,126C,133C,140C,147C,154C,164C,175C 'sit':74B 'unauthent':69B,105C 'uniniti':15A,65B,100C 'v3.6':176C 'v4.0':165C 'v4.2':155C 'v4.4':148C 'v5.0':141C 'v6.0':134C 'v7.0':113C 'v8.0':120C 'v8.2':127C 'version':117C,121C,128C,135C,142C,149C,156C,166C,177C 'whatev':73B 'zlib':6A,53B,91C 'zlib-compress':52B","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2025-12-19T11:15:49+00:00","kev":{"dateAdded":"2025-12-29","dueDate":"2026-01-19","requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@mongodb.com","poc_count":1,"sources":[{"source":"kev","external_id":"CVE-2025-14847","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-14847","severity":null,"published_at":"2025-12-29T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:51+00:00","fetched_at":"2026-10-25T17:39:55+00:00","note":null},{"source":"github-poc","external_id":"SAIM28826/CVE-2025-14847-poc","url":"https://github.com/SAIM28826/CVE-2025-14847-poc","severity":null,"published_at":"2026-10-22T02:46:18+00:00","modified_at":null,"first_seen_at":"2026-10-23T20:22:17+00:00","fetched_at":"2026-10-23T20:22:17+00:00","note":null},{"source":"nvd","external_id":"CVE-2025-14847","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-14847","severity":null,"published_at":"2025-12-19T11:15:49+00:00","modified_at":"2026-06-17T08:36:38+00:00","first_seen_at":"2026-10-23T23:44:51+00:00","fetched_at":"2026-10-23T23:44:51+00:00","note":null}],"documents":[{"id":683,"url":"https://github.com/SAIM28826/CVE-2025-14847-poc","title":"SAIM28826/CVE-2025-14847-poc","kind":"poc","source":"github","text":"​CVE-2025-14847 proof of concept script for testing\n\nstars 1","published_at":"2026-10-22T02:46:18+00:00","relation":"poc","confidence":null,"note":"1 stars"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}