CVE Feed

    Dashboard / CVE / CVE-2025-14847

    CVE-2025-14847

    Mismatched length fields in Zlib compressed protocol headers may allow a read of uninitialized heap memory by an unauthenticated client. This issue affects all MongoDB Server v7.0 prior to 7.0.28 versions, MongoDB Server v8.0 versions prior to 8.0.17, MongoDB Server v8.2 versions prior to 8.2.3, MongoDB Server v6.0 versions prior to 6.0.27, MongoDB Server v5.0 versions prior to 5.0.32, MongoDB Server v4.4 versions prior to 4.4.30, MongoDB Server v4.2 versions greater than or equal to 4.2.0, MongoDB Server v4.0 versions greater than or equal to 4.0.0, and MongoDB Server v3.6 versions greater than or equal to 3.6.0.

    Published:Dec 19, 2025
    Last Modified:Feb 26, 2026
    EPS:Dec 19, 2025
    EPSS Score:0.64807
    CVSS Score:7.5

    CISA Notification

    Description

    Mismatched length fields in Zlib compressed protocol headers may allow a read of uninitialized heap memory by an unauthenticated client. This issue affects all MongoDB Server v7.0 prior to 7.0.28 versions, MongoDB Server v8.0 versions prior to 8.0.17, MongoDB Server v8.2 versions prior to 8.2.3, MongoDB Server v6.0 versions prior to 6.0.27, MongoDB Server v5.0 versions prior to 5.0.32, MongoDB Server v4.4 versions prior to 4.4.30, MongoDB Server v4.2 versions greater than or equal to 4.2.0, MongoDB Server v4.0 versions greater than or equal to 4.0.0, and MongoDB Server v3.6 versions greater than or equal to 3.6.0.

    Required Action:

    Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

    Notes:

    No extra notes provided.

    Due Date
    Jan 19, 2026
    235 days ago
    Alert Date
    Dec 29, 2025
    256 days ago

    Affected Products

    Vendor
    Mongodb
    Product
    Mongodb

    Exploits

    https://www.vicarius.io/vsociety/posts/cve-2025-14847-detection-script-heap-memory-exposure-in-mongodb-serverhttps://www.vicarius.io/vsociety/posts/cve-2025-14847-mitigation-script-heap-memory-exposure-in-mongodb-serverhttps://github.com/0xAshwesker/CVE-2025-14847https://github.com/0xBlackash/CVE-2025-14847https://github.com/14mb1v45h/CYBERDUDEBIVASH-MONGODB-DETECTOR-v2026https://github.com/AdolfBharath/mongobleedhttps://github.com/alexcyberx/CVE-2025-14847_Expolithttps://github.com/amnnrth/CVE-2025-14847https://github.com/Black1hp/mongobleed-scannerhttps://github.com/CadGoose/MongoBleed-CVE-2025-14847-Fully-Automated-scannerhttps://github.com/chinaxploiter/CVE-2025-14847-PoChttps://github.com/codeb0ssx/CVE-2025-14847-PoChttps://github.com/cybertechajju/CVE-2025-14847_Expolithttps://github.com/dawnsmithcyber/azure-vulnerability-remediation-projecthttps://github.com/ElJoamy/MongoBleed-exploithttps://github.com/franksec42/mongobleed-exploit-CVE-2025-14847https://github.com/FurkanKAYAPINAR/CVE-2025-14847-MongoBleed-Exploithttps://github.com/im-hanzou/mongobleedhttps://github.com/InfoSecAntara/CVE-2025-14847-MongoDBhttps://github.com/j0lt-github/mongobleedburphttps://github.com/JemHadar/MongoBleed-DFIR-Triage-Script-CVE-2025-14847https://github.com/joshuavanderpoll/CVE-2025-14847https://github.com/keraattin/Mongobleed-Detector-CVE-2025-14847https://github.com/KingHacker353/CVE-2025-14847_Expolithttps://github.com/kuyrathdaro/cve-2025-14847https://github.com/lincemorado97/CVE-2025-14847https://github.com/nma-io/mongobleedhttps://github.com/NoNameError/MongoBLEED---CVE-2025-14847-POC-https://github.com/onewinner/CVE-2025-14847https://github.com/peakcyber-security/CVE-2025-14847https://github.com/pedrocruz2202/mongobleed-scannerhttps://github.com/pedrocruz2202/pedrocruz2202.github.iohttps://github.com/ProbiusOfficial/CVE-2025-14847https://github.com/Rishi-kaul/CVE-2025-14847-MongoBleedhttps://github.com/saereya/CVE-2025-14847---MongoBleedhttps://github.com/sahar042/CVE-2025-14847https://github.com/sakthivel10q/CVE-2025-14847https://github.com/sakthivel10q/sakthivel10q.github.iohttps://github.com/Security-Phoenix-demo/mongobleed-exploit-CVE-2025-14847https://github.com/shokribardiya/CVE-2025-14847-mongobleedhttps://github.com/sho-luv/MongoBleedhttps://github.com/Systemhaus-Schulz/MongoBleed-CVE-2025-14847https://github.com/tunahantekeoglu/MongoDeepDivehttps://github.com/vfa-tuannt/CVE-2025-14847https://github.com/waheeb71/CVE-2025-14847

    Common Attack Pattern Enumeration and Classification (CAPEC)

    CAPEC-47 Buffer Overflow via Parameter Expansion

    Related CVEs

    CVE-2026-84967 (CVSS 5.1) — A component of the MongoDB extension for Visual Studio Code does not neutralize special characters in a connec…
    CVE-2026-13071 (CVSS 7.1) — An authenticated user with read access can cause the mongod process to be terminated through certain aggregati…
    CVE-2026-13072 (CVSS 9.2) — When compute mode is enabled on a standalone mongod instance, insufficient validation of externally sourced BS…
    CVE-2026-13073 (CVSS 5.3) — An authenticated user with read-only privileges can cause the mongod process to terminate abnormally by issuin…
    CVE-2026-13074 (CVSS 6.9) — An unauthenticated remote client can cause excessive CPU consumption on a MongoDB server by sending a specific…
    CVE-2026-13075 (CVSS 7.1) — An authenticated user can cause the mongod process to be terminated by the operating system under memory press…
    CVE-2026-13076 (CVSS 7.1) — An authenticated user can cause a {{mongod}} process to be terminated by the operating system under memory pre…
    CVE-2026-13077 (CVSS 7.1) — A missing bounds check in the BSON CodeWScope element accessors allows an attacker to trigger an out-of-bounds…
    CVE-2026-13078 (CVSS 6.3) — A vulnerability was discovered in MongoDB Server where the server-side MozJS scripting engine unconditionally …
    CVE-2026-11933 (CVSS 8.7) — A use-after-free vulnerability exists in MongoDB Server's server-side JavaScript engine when converting BSON d…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High