CVE-2025-14847Zlib compressed protocol header length confusion may allow memory read

Mismatched length fields in Zlib compressed protocol headers may allow a read of uninitialized heap memory by an unauthenticated client. This issue affects all MongoDB Server v7.0 prior to 7.0.28 versions, MongoDB Server v8.0 versions prior to 8.0.17, MongoDB Server v8.2 versions prior to 8.2.3, MongoDB Server v6.0 versions prior to 6.0.27, MongoDB Server v5.0 versions prior to 5.0.32, MongoDB Server v4.4 versions prior to 4.4.30, MongoDB Server v4.2 versions greater than or equal to 4.2.0, MongoDB Server v4.0 versions greater than or equal to 4.0.0, and MongoDB Server v3.6 versions greater than or equal to 3.6.0.

8.7 HIGHEPSS 83.21%⚡ Known Exploited (CISA KEV)NVD: Analyzed

Last updated: 2026-06-17 08:36 UTC

OverviewCVSS details

8.7HIGHCVSS 4.0

Score source: mongodb (CNA)
NVD status: Analyzed
Published: Dec 19, 2025
Assigner: mongodb

Affected

MongoDB Server (MongoDB Inc.)

Versions: 8.2 before 8.2.3 · 8.0 before 8.0.17
Fixed in: 8.2.3, 8.0.17, 7.0.28

All affected versions →

Exploitation

Public exploit: Yes · 2 references
CISA KEV: Listed · Dec 29, 2025
KEV due date: Jan 19, 2026
Ransomware use: Unknown
SSVC: Exploitation active · Automatable yes · Impact partial

EPSS · FIRST, scored Nov 7

83.21%chance of exploitation in 30 days

Higher than 99.68% of CVEs

CVSS 4.0 · mongodb (CNA)

8.7High

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Attack vector: Network
Attack complexity: Low
Attack requirements: None
Privileges required: None
User interaction: None
Confidentiality impact: High
Integrity impact: None
Availability impact: None
Confidentiality (other systems): None
Integrity (other systems): None
Availability (other systems): None

CVSS 3.1 · mongodb (CNA)

7.5High

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack vector: Network
Attack complexity: Low
Privileges required: None
User interaction: None
Scope: Unchanged
Confidentiality impact: High
Integrity impact: None
Availability impact: None

NVD status: Analyzed

Overview Affected Products References

NVD CVE.org

Overview

Severity

Score	Severity	Version	Vector String
8.7	HIGH	4.0mongodb (CNA)	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
7.5	HIGH	3.1mongodb (CNA)	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CISA required action

⚡ Known exploited · remediation due Jan 19, 2026

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Details

CVE ID: CVE-2025-14847
Status: Analyzed
Assigner (CNA): mongodb
Published: Dec 19, 2025
Last modified: 2026-06-17 08:36 UTC
Weaknesses: CWE-130 · Improper Handling of Length Parameter Inconsistency

Sources

Refreshed hourly from the sources above. Last fetched 2026-11-08 10:32 UTC.