Every CVE Search/ Get API key

CVE-2025-14847

Zlib compressed protocol header length confusion may allow memory read

8.7 HighIn KEVPublic exploitFix available

Mismatched length fields in Zlib compressed protocol headers may allow a read of uninitialized heap memory by an unauthenticated client. This issue affects all MongoDB Server v7.0 prior to 7.0.28 versions, MongoDB Server v8.0 versions prior to 8.0.17, MongoDB Server v8.2 versions prior to 8.2.3, MongoDB Server v6.0 versions prior to 6.0.27, MongoDB Server v5.0 versions prior to 5.0.32, MongoDB Server v4.4 versions prior to 4.4.30, MongoDB Server v4.2 versions greater than or equal to 4.2.0, MongoDB Server v4.0 versions greater than or equal to 4.0.0, and MongoDB Server v3.6 versions greater than or equal to 3.6.0.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
None
Availability
None

Exploit likelihood

83.2%Up 83.2 points since Dec 19, 2025
90%50%10%1%

What each source reports

CVE List Score used 8.7

Zlib compressed protocol header length confusion may allow memory read

Mismatched length fields in Zlib compressed protocol headers may allow a read of uninitialized heap memory by an unauthenticated client. This issue affects all MongoDB Server v7.0 prior to 7.0.28 versions, MongoDB Server v8.0 versions prior to 8.0.17, MongoDB Server v8.2 versions prior to 8.2.3, MongoDB Server v6.0 versions prior to 6.0.27, MongoDB Server v5.0 versions prior to 5.0.32, MongoDB Server v4.4 versions prior to 4.4.30, MongoDB Server v4.2 versions greater than or equal to 4.2.0, MongoDB Server v4.0 versions greater than or equal to 4.0.0, and MongoDB Server v3.6 versions greater than or equal to 3.6.0.

Record
CVE-2025-14847
CVSS 4.0
8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness
CWE-130
Updated
2026-11-02
EUVDEUVD-2025-204529 8.7

Mismatched length fields in Zlib compressed protocol headers may allow a read of uninitialized heap memory by an unauthenticated client. This issue affects all MongoDB Server v7.0 prior to 7.0.28 versions, MongoDB Server v8.0 versions prior to 8.0.17, MongoDB Server v8.2 versions prior to 8.2.3, MongoDB Server v6.0 versions prior to 6.0.27, MongoDB Server v5.0 versions prior to 5.0.32, MongoDB Server v4.4 versions prior to 4.4.30, MongoDB Server v4.2 versions greater than or equal to 4.2.0, MongoDB Server v4.0 versions greater than or equal to 4.0.0, and MongoDB Server v3.6 versions greater than or equal to 3.6.0.

Record
EUVD-2025-204529
CVSS 4.0
8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-4742-mr57-2r9j 8.7

Mismatched length fields in Zlib compressed protocol headers may allow a read of uninitialized...

Mismatched length fields in Zlib compressed protocol headers may allow a read of uninitialized heap memory by an unauthenticated client. This issue affects all MongoDB Server v7.0 prior to 7.0.28 versions, MongoDB Server v8.0 versions prior to 8.0.17, MongoDB Server v8.2 versions prior to 8.2.3, MongoDB Server v6.0 versions prior to 6.0.27, MongoDB Server v5.0 versions prior to 5.0.32, MongoDB Server v4.4 versions prior to 4.4.30, MongoDB Server v4.2 versions greater than or equal to 4.2.0, MongoDB Server v4.0 versions greater than or equal to 4.0.0, and MongoDB Server v3.6 versions greater than or equal to 3.6.0.

Record
GHSA-4742-mr57-2r9j
CVSS 4.0
8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness
CWE-130
Updated
2026-11-02
CISA KEV No score

MongoDB and MongoDB Server Improper Handling of Length Parameter Inconsistency Vulnerability

MongoDB Server contains an improper handling of length parameter inconsistency vulnerability in Zlib compressed protocol headers. This vulnerability may allow a read of uninitialized heap memory by an unauthenticated client.

Record
CVE-2025-14847
Weakness
CWE-130
Updated
2026-11-02
NVD 8.7

Mismatched length fields in Zlib compressed protocol headers may allow a read of uninitialized heap memory by an unauthenticated client. This issue affects all MongoDB Server v7.0 prior to 7.0.28 versions, MongoDB Server v8.0 versions prior to 8.0.17, MongoDB Server v8.2 versions prior to 8.2.3, MongoDB Server v6.0 versions prior to 6.0.27, MongoDB Server v5.0 versions prior to 5.0.32, MongoDB Server v4.4 versions prior to 4.4.30, MongoDB Server v4.2 versions greater than or equal to 4.2.0, MongoDB Server v4.0 versions greater than or equal to 4.0.0, and MongoDB Server v3.6 versions greater than or equal to 3.6.0.

Record
CVE-2025-14847
CVSS 4.0
8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness
CWE-130
Updated
2026-11-02
OSV 8.7

Zlib compressed protocol header length confusion may allow memory read

Mismatched length fields in Zlib compressed protocol headers may allow a read of uninitialized heap memory by an unauthenticated client. This issue affects all MongoDB Server v7.0 prior to 7.0.28 versions, MongoDB Server v8.0 versions prior to 8.0.17, MongoDB Server v8.2 versions prior to 8.2.3, MongoDB Server v6.0 versions prior to 6.0.27, MongoDB Server v5.0 versions prior to 5.0.32, MongoDB Server v4.4 versions prior to 4.4.30, MongoDB Server v4.2 versions greater than or equal to 4.2.0, MongoDB Server v4.0 versions greater than or equal to 4.0.0, and MongoDB Server v3.6 versions greater than or equal to 3.6.0.

Record
CVE-2025-14847
CVSS 4.0
8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Weakness
CWE-130
Updated
2026-11-02
Show 5 moreShow less
OSVUBUNTU-CVE-2025-14847 8.7

Mismatched length fields in Zlib compressed protocol headers may allow a read of uninitialized heap memory by an unauthenticated client. This issue affects all MongoDB Server v7.0 prior to 7.0.28 versions, MongoDB Server v8.0 versions prior to 8.0.17, MongoDB Server v8.2 versions prior to 8.2.3, MongoDB Server v6.0 versions prior to 6.0.27, MongoDB Server v5.0 versions prior to 5.0.32, MongoDB Server v4.4 versions prior to 4.4.30, MongoDB Server v4.2 versions greater than or equal to 4.2.0, MongoDB Server v4.0 versions greater than or equal to 4.0.0, and MongoDB Server v3.6 versions greater than or equal to 3.6.0.

Record
UBUNTU-CVE-2025-14847
CVSS 4.0
8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
OSVBIT-mongodb-2025-14847 No score

Zlib compressed protocol header length confusion may allow memory read

Mismatched length fields in Zlib compressed protocol headers may allow a read of uninitialized heap memory by an unauthenticated client. This issue affects all MongoDB Server v7.0 prior to 7.0.28 versions, MongoDB Server v8.0 versions prior to 8.0.17, MongoDB Server v8.2 versions prior to 8.2.3, MongoDB Server v6.0 versions prior to 6.0.27, MongoDB Server v5.0 versions prior to 5.0.32, MongoDB Server v4.4 versions prior to 4.4.30, MongoDB Server v4.2 versions greater than or equal to 4.2.0, MongoDB Server v4.0 versions greater than or equal to 4.0.0, and MongoDB Server v3.6 versions greater than or equal to 3.6.0.

Record
BIT-mongodb-2025-14847
Updated
2026-11-02
OSVCLSA-2026-1773757893 No score

Fix CVE(s): CVE-2025-14847

  • SECURITY UPDATE: Unauthenticated heap memory disclosure via mismatched zlib compressed protocol headers (MongoBleed)
    • debian/patches/CVE-2025-14847.patch: Return actual decompressed size instead of buffer size in ZlibMessageCompressor::decompressData
    • CVE-2025-14847
Record
CLSA-2026-1773757893
Updated
2026-11-02
OSVCLSA-2026-1773768694 No score

Fix CVE(s): CVE-2025-14847

  • SECURITY UPDATE: Unauthenticated heap memory disclosure via mismatched zlib compressed protocol headers (MongoBleed)
    • debian/patches/CVE-2025-14847.patch: Return actual decompressed size instead of buffer size in ZlibMessageCompressor::decompressData
    • CVE-2025-14847
Record
CLSA-2026-1773768694
Updated
2026-11-02
OSVUSN-8160-1 No score

mongodb vulnerability

It was discovered that MongoDB incorrectly handled length parameters in zlib-compressed network messages prior to authentication. An unauthenticated remote attacker could possibly use this issue to cause MongoDB to allocate an oversized memory buffer, resulting in the exposure of sensitive information.

Record
USN-8160-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
mongodb
Bitnami
 4.4.0 up to 4.4.30, 5.0.0 up to 5.0.32, 6.0.0 up to 6.0.27, 7.0.0 up to 7.0.28, 8.0.0 up to 8.0.17, 8.2.0 up to 8.2.3
4.4.305.0.326.0.277.0.288.0.178.2.3
mongodb
TuxCare:Ubuntu:18.04
 before 1:3.6.3-0ubuntu1.4+tuxcare.els1
1:3.6.3-0ubuntu1.4+tuxcare.els1
mongodb-clients
TuxCare:Ubuntu:18.04
 before 1:3.6.3-0ubuntu1.4+tuxcare.els1
1:3.6.3-0ubuntu1.4+tuxcare.els1
mongodb-server
TuxCare:Ubuntu:18.04
 before 1:3.6.3-0ubuntu1.4+tuxcare.els1
1:3.6.3-0ubuntu1.4+tuxcare.els1
mongodb-server-core
TuxCare:Ubuntu:18.04
 before 1:3.6.3-0ubuntu1.4+tuxcare.els1
1:3.6.3-0ubuntu1.4+tuxcare.els1
mongodb
TuxCare:Ubuntu:20.04
 before 1:3.6.9+really3.6.8+90~g8e540c0b6d-0ubuntu5.3+tuxcare.els1
1:3.6.9+really3.6.8+90~g8e540c0b6d-0ubuntu5.3+tuxcare.els1
mongodb-clients
TuxCare:Ubuntu:20.04
 before 1:3.6.9+really3.6.8+90~g8e540c0b6d-0ubuntu5.3+tuxcare.els1
1:3.6.9+really3.6.8+90~g8e540c0b6d-0ubuntu5.3+tuxcare.els1
mongodb-server
TuxCare:Ubuntu:20.04
 before 1:3.6.9+really3.6.8+90~g8e540c0b6d-0ubuntu5.3+tuxcare.els1
1:3.6.9+really3.6.8+90~g8e540c0b6d-0ubuntu5.3+tuxcare.els1
mongodb-server-core
TuxCare:Ubuntu:20.04
 before 1:3.6.9+really3.6.8+90~g8e540c0b6d-0ubuntu5.3+tuxcare.els1
1:3.6.9+really3.6.8+90~g8e540c0b6d-0ubuntu5.3+tuxcare.els1
mongodb
Ubuntu:Pro:18.04:LTS
 before 1:3.6.3-0ubuntu1.4+esm2, plus listed versions
1:3.4.7-11:3.4.7-1ubuntu11:3.4.7-1ubuntu21:3.4.7-1ubuntu41:3.4.14-3ubuntu1
Show 6 moreShow less
1:3.4.14-3ubuntu21:3.6.3-0ubuntu11:3.6.3-0ubuntu1.11:3.6.3-0ubuntu1.31:3.6.3-0ubuntu1.41:3.6.3-0ubuntu1.4+esm1
1:3.6.3-0ubuntu1.4+esm2
mongodb
Ubuntu:Pro:20.04:LTS
 before 1:3.6.9+really3.6.8+90~g8e540c0b6d-0ubuntu5.3+esm1, plus listed versions
1:3.6.9+really3.6.8+90~g8e540c0b6d-0ubuntu21:3.6.9+really3.6.8+90~g8e540c0b6d-0ubuntu51:3.6.9+really3.6.8+90~g8e540c0b6d-0ubuntu5.21:3.6.9+really3.6.8+90~g8e540c0b6d-0ubuntu5.3
1:3.6.9+really3.6.8+90~g8e540c0b6d-0ubuntu5.3+esm1

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
PoC in GitHubProbiusOfficial/CVE-2025-148472025-12-26
PoC in GitHubonewinner/CVE-2025-148472025-12-26
PoC in GitHubBlack1hp/mongobleed-scanner2025-12-27
PoC in GitHubKingHacker353/CVE-2025-14847_Expolit2025-12-27
PoC in GitHubcybertechajju/CVE-2025-14847_Expolit2025-12-27
PoC in GitHubnma-io/mongobleed2025-12-27
PoC in GitHubsaereya/CVE-2025-14847---MongoBleed2025-12-27
PoC in GitHubJemHadar/MongoBleed-DFIR-Triage-Script-CVE-2025-148472025-12-28
PoC in GitHubfranksec42/mongobleed-exploit-CVE-2025-148472025-12-28
PoC in GitHub14mb1v45h/CYBERDUDEBIVASH-MONGODB-DETECTOR-v20262025-12-29
Show 17 moreShow less
Public exploits
SourceLinkDate
PoC in GitHubSecurity-Phoenix-demo/mongobleed-exploit-CVE-2025-148472025-12-29
PoC in GitHubcodeb0ssx/CVE-2025-14847-PoC2025-12-29
PoC in GitHubjoshuavanderpoll/CVE-2025-148472025-12-29
PoC in GitHubkuyrathdaro/cve-2025-148472025-12-29
PoC in GitHubtunahantekeoglu/MongoDeepDive2025-12-29
PoC in GitHubFurkanKAYAPINAR/CVE-2025-14847-MongoBleed-Exploit2025-12-30
PoC in GitHubNoNameError/MongoBLEED---CVE-2025-14847-POC-2025-12-30
PoC in GitHubj0lt-github/mongobleedburp2025-12-30
PoC in GitHubRishi-kaul/CVE-2025-14847-MongoBleed2025-12-31
PoC in GitHubSystemhaus-Schulz/MongoBleed-CVE-2025-148472026-01-01
PoC in GitHubElJoamy/MongoBleed-exploit2026-01-02
PoC in GitHubkeraattin/Mongobleed-Detector-CVE-2025-148472026-01-04
PoC in GitHubwaheeb71/CVE-2025-148472026-01-06
PoC in GitHubCadGoose/MongoBleed-CVE-2025-14847-Fully-Automated-scanner2026-01-07
PoC in GitHubim-hanzou/mongobleed2026-01-08
MetasploitMongoDB Memory Disclosure (CVE-2025-14847) - Mongobleed2025-12-19
NucleiMongoDB Server - Information Disclosure (MongoBleed)

History

History
RecordedChangedSources
exploits, exploits_morePoC in GitHub
exploitation
exploits, exploits_more
exploits
first indexedCVE List, EUVD, GitHub Advisories, CISA KEV, Metasploit, Nuclei, NVD, OSV, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2025-14847 is a high vulnerability (CVSS 8.7) in Mongodb, published December 19, 2025. CISA lists it as known to be exploited, since December 29, 2025. EUVD reports exploitation since December 29, 2025. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 83.2%, the 99th percentile. Fixed in mongodb 4.4.30.

References

Show 10 moreShow less
This page doesn't list everything

The full exploit list has 14 more links.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open