---
id: "CVE-2025-14847"
kind: "vulnerability"
aliases: ["CVE-2025-14847"]
title: "mongodb: Mismatched length fields in Zlib compressed protocol headers may allow a read of uninitialized heap memory by an\u2026"
severity: "high"
cvss: 8.7
epss: null
exploited: true
status: "open"
category: "infrastructure"
products: [{"name": "MongoDB MongoDB and MongoDB Server", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "mongodb", "fixed": ["4.4.30"], "affected": ">= 3.6.0, < 4.4.30", "ecosystem": "vendor"}, {"name": "mongodb", "fixed": ["5.0.32"], "affected": ">= 5.0.0, < 5.0.32", "ecosystem": "vendor"}, {"name": "mongodb", "fixed": ["6.0.27"], "affected": ">= 6.0.0, < 6.0.27", "ecosystem": "vendor"}, {"name": "mongodb", "fixed": ["7.0.28"], "affected": ">= 7.0.0, < 7.0.28", "ecosystem": "vendor"}, {"name": "mongodb", "fixed": ["8.0.17"], "affected": ">= 8.0.0, < 8.0.17", "ecosystem": "vendor"}, {"name": "mongodb", "fixed": ["8.2.3"], "affected": ">= 8.2.0, < 8.2.3", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["database", "exploited", "infrastructure", "mongodb", "poc-public", "self-hosted"]
not_affected_if: ["managed-hosting", "zlib-compression-disabled"]
published_at: "2025-12-19T11:15:49+00:00"
first_seen_at: "2026-10-23T19:11:51+00:00"
updated_at: "2026-10-23T23:44:51+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-14847", "first_seen_at": "2026-10-23T19:11:51+00:00"}, {"source": "github-poc", "url": "https://github.com/SAIM28826/CVE-2025-14847-poc", "first_seen_at": "2026-10-23T20:22:17+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-14847", "first_seen_at": "2026-10-23T23:44:51+00:00"}]
---

# mongodb: Mismatched length fields in Zlib compressed protocol headers may allow a read of uninitialized heap memory by an…

MongoDB Server mishandles a length field in Zlib-compressed protocol headers, so a remote client can make it read uninitialized heap memory. An unauthenticated attacker can leak whatever sits in server memory, which may include credentials or data from other operations.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:MongoDB MongoDB and MongoDB Server affected ? fixed ?
- vendor:mongodb affected >= 3.6.0, < 4.4.30 fixed 4.4.30
- vendor:mongodb affected >= 5.0.0, < 5.0.32 fixed 5.0.32
- vendor:mongodb affected >= 6.0.0, < 6.0.27 fixed 6.0.27
- vendor:mongodb affected >= 7.0.0, < 7.0.28 fixed 7.0.28
- vendor:mongodb affected >= 8.0.0, < 8.0.17 fixed 8.0.17
- vendor:mongodb affected >= 8.2.0, < 8.2.3 fixed 8.2.3

## How to check

Check the MongoDB server version against the vendor advisory (unknown from sources which versions are affected).
Check whether zlib wire protocol compression is enabled (networkMessageCompressors includes zlib) and whether port 27017 is reachable from untrusted networks.

## Fix

Upgrade MongoDB Server to a patched release listed in the vendor advisory (unknown from sources which version).
Until patched, disable zlib compression on the server and restrict network access to MongoDB ports.

## Timeline

- 2026-10-23T19:11:51+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-14847
- 2026-10-23T20:22:17+00:00 github-poc https://github.com/SAIM28826/CVE-2025-14847-poc
- 2026-10-23T23:44:51+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2025-14847

## Documents

- [poc] SAIM28826/CVE-2025-14847-poc https://github.com/SAIM28826/CVE-2025-14847-poc

## From the sources

Mismatched length fields in Zlib compressed protocol headers may allow a read of uninitialized heap memory by an unauthenticated client. This issue affects all MongoDB Server v7.0 prior to 7.0.28 versions, MongoDB Server v8.0 versions prior to 8.0.17, MongoDB Server v8.2 versions prior to 8.2.3, MongoDB Server v6.0 versions prior to 6.0.27, MongoDB Server v5.0 versions prior to 5.0.32, MongoDB Server v4.4 versions prior to 4.4.30, MongoDB Server v4.2 versions greater than or equal to 4.2.0, MongoDB Server v4.0 versions greater than or equal to 4.0.0, and MongoDB Server v3.6 versions greater than or equal to 3.6.0.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_