CVE-2025-14847

CVE-2025-14847 ('MongoBleed') is an improper handling of length parameter inconsistency (CWE-130) in MongoDB Server's processing of Zlib-compressed protocol headers, where mismatched length fields cause the server to return uninitialized heap memory. An unauthenticated remote client can trigger the leak by sending specially crafted compressed protocol messages to a vulnerable server, with no credentials, user interaction, or complex conditions required. The impact is confidentiality-only: an attacker can harvest fragments of the server's heap memory, which may contain sensitive in-memory data such as documents, credentials, or keys, reflected in the High confidentiality rating in the 8.7 CVSS 4.0 score. Virtually every MongoDB Server release from 3.6 through 8.2 is affected unless updated to the fixed patch levels (e.g., 8.2.3, 8.0.17, 7.0.28, 6.0.27, 5.0.32, 4.4.30), so the potentially exposed population is extremely large. The flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2025-12-29, is reported as actively exploited in the wild worldwide (including a joint US-Australia advisory), and carries a very high EPSS of 83.2%, making patching urgent.

What to do: Upgrade MongoDB Server immediately to the fixed release for your branch: 8.2.3+, 8.0.17+, 7.0.28+, 6.0.27+, 5.0.32+, or 4.4.30+; 3.6, 4.0, and 4.2 deployments are affected in all versions and should be moved to a patched release or retired per MongoDB guidance. Until patched, restrict network access to MongoDB to trusted clients and consider disabling Zlib network compression as an interim mitigation, and review logs for unauthenticated client connections. Because the flaw is on CISA's KEV catalog with active exploitation observed (including ransomware-adjacent tracking), apply mitigations per BOD 22-01 timelines or discontinue use of affected unpatched instances.