⚠ Actively exploited
Added to CISA KEV on 2025-12-29. Federal agencies required to patch by 2026-01-19. Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable..
CVE-2025-14847 — Improper Handling of Length Parameter Inconsistency in INC Mongodb Server
Severity
8.7HIGHNVD
EPSS
77.5%
top 1.01%
CISA KEV
KEV
Added 2025-12-29
Due 2026-01-19
Exploit
PoC available
Public exploit / PoC exists
Affected products
Timeline
PublishedDec 19
KEV addedDec 29
KEV dueJan 19
Latest updateApr 9
CISA Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Description
Mismatched length fields in Zlib compressed protocol headers may allow a read of uninitialized heap memory by an unauthenticated client. This issue affects all MongoDB Server v7.0 prior to 7.0.28 versions, MongoDB Server v8.0 versions prior to 8.0.17, MongoDB Server v8.2 versions prior to 8.2.3, MongoDB Server v6.0 versions prior to 6.0.27, MongoDB Server v5.0 versions prior to 5.0.32, MongoDB Server v4.4 versions prior to 4.4.30, MongoDB Server v4.2 versions greater than or equal to 4.2.0, Mong…
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Affected Packages2 packages
Patches
🔴Vulnerability Details
4GHSA▶
GHSA-4742-mr57-2r9j: Mismatched length fields in Zlib compressed protocol headers may allow a read of uninitialized heap memory by an unauthenticated client↗2025-12-19
OSV▶
CVE-2025-14847: Mismatched length fields in Zlib compressed protocol headers may allow a read of uninitialized heap memory by an unauthenticated client↗2025-12-19
VulnCheck
▶
💥Exploits & PoCs
2Nuclei▶
MongoDB Server - Information Disclosure (MongoBleed)