CVE-2025-14847: MongoDB and MongoDB Server Improper Handling of Length Parameter Inconsistency Vulnerability
Mismatched length fields in Zlib compressed protocol headers may allow a read of uninitialized heap memory by an unauthenticated client. This issue affects all MongoDB Server v7.0 prior to 7.0.28 versions, MongoDB Server v8.0 versions prior to 8.0.17, MongoDB Server v8.2 versions prior to 8.2.3, MongoDB Server v6.0 versions prior to 6.0.27, MongoDB Server v5.0 versions prior to 5.0.32, MongoDB Server v4.4 versions prior to 4.4.30, MongoDB Server v4.2 versions greater than or equal to 4.2.0, MongoDB Server v4.0 versions greater than or equal to 4.0.0, and MongoDB Server v3.6 versions greater than or equal to 3.6.0.
Other sources
MongoDB Server contains an improper handling of length parameter inconsistency vulnerability in Zlib compressed protocol headers. This vulnerability may allow a read of uninitialized heap memory by an unauthenticated client.
— CISA
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
MongoDB Serverto a version that resolves this vulnerability.Fixed in 7.0.28 - Upgrade
Upgrade
MongoDB Serverto a version that resolves this vulnerability.Fixed in 8.0.17 - Upgrade
Upgrade
MongoDB Serverto a version that resolves this vulnerability.Fixed in 8.2.3 - Upgrade
Upgrade
MongoDB Serverto a version that resolves this vulnerability.Fixed in 6.0.27 - Upgrade
Upgrade
MongoDB Serverto a version that resolves this vulnerability.Fixed in 5.0.32 - Upgrade
Upgrade
MongoDB Serverto a version that resolves this vulnerability.Fixed in 4.4.30 - Upgrade
Upgrade
MongoDB Serverto a version that resolves this vulnerability.Fixed in 4.2.0 - Upgrade
Upgrade
MongoDB Serverto a version that resolves this vulnerability.Fixed in 4.0.0 - Upgrade
Upgrade
MongoDB Serverto a version that resolves this vulnerability.Fixed in 3.6.0 - Compensating control
If mitigations are unavailable, discontinue use of the MongoDB product (CVE-2025-14847: mismatched length fields in Zlib compressed protocol headers that can allow an unauthenticated client to read uninitialized heap memory).
- Compensating control
Apply mitigations per vendor instructions and follow applicable BOD 22-01 guidance for cloud services for CVE-2025-14847.
Event History
Frequently Asked Questions
What is the severity of CVE-2025-14847?
CVE-2025-14847 has a high severity due to the potential for unauthorized access to uninitialized heap memory.
How do I fix CVE-2025-14847?
To fix CVE-2025-14847, upgrade to MongoDB Server version 7.0.28 or later, 8.0.17 or later, or 8.2.3 or later.
Which versions of MongoDB are affected by CVE-2025-14847?
CVE-2025-14847 affects MongoDB Server versions prior to 7.0.28, 8.0.17, and 8.2.3.
Can CVE-2025-14847 be exploited by authenticated users?
No, CVE-2025-14847 can be exploited by unauthenticated clients.
What is the impact of CVE-2025-14847 on MongoDB Server?
The impact of CVE-2025-14847 could include the exposure of sensitive data due to reading uninitialized memory.