Zlib compressed protocol header length confusion may allow memory read
Affects MongoDB Server 4.4 through 8.2 when zlib compression is enabled for network messages. Fixed in 8.2.3, 8.0.17, 7.0.28, 6.0.27, 5.0.32, and 4.4.30.
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Listed in CISA KEV
- How many real-world setups can hit the bug, from the vendor's advisory and CISA data. It does not know your setup.What do these mean? →
- Actively exploited
- Fix
- Fixed in 8.2.3, 8.0.17, 7.0.28, 6.0.27, 5.0.32, and 1 more
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
The vulnerability affects MongoDB Server across many release lines, including versions 3.6 through 8.2. An unauthenticated client could exploit mismatched length fields in Zlib-compressed protocol headers to read uninitialized heap memory on the server, potentially exposing sensitive data.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
Mismatched length fields in Zlib compressed protocol headers may allow a read of uninitialized heap memory by an unauthenticated client. This issue affects all MongoDB Server v7.0 prior to 7.0.28 versions, MongoDB Server v8.0 versions prior to 8.0.17, MongoDB Server v8.2 versions prior to 8.2.3, MongoDB Server v6.0 versions prior to 6.0.27, MongoDB Server v5.0 versions prior to 5.0.32, MongoDB Server v4.4 versions prior to 4.4.30, MongoDB Server v4.2 versions greater than or equal to 4.2.0, MongoDB Server v4.0 versions greater than or equal to 4.0.0, and MongoDB Server v3.6 versions greater than or equal to 3.6.0.
Timeline
- CVE published
- Added to CISA KEV
CISA has evidence of exploitation in the wild
- CISA remediation deadline
Due date for US federal agencies to patch
- Record last updated
- EPSS reached 10%
FIRST estimates at least a 10% chance of exploitation in the next 30 days
Affected versions
- MongoDB Inc. MongoDB Server
From 8.2 · fixed in 8.2.3; From 8.0 · fixed in 8.0.17; From 7.0 · fixed in 7.0.28; From 6.0 · fixed in 6.0.27; From 5.0 · fixed in 5.0.32; From 4.4 · fixed in 4.4.30
References 1
jira.mongodb.org
Questions about CVE-2025-14847
What does this mean?
A client can send a crafted zlib-compressed protocol message with an inconsistent header length, which can make the server return uninitialized heap memory. The facts say this can happen without authenticating to the server.Source: jira.mongodb.org
Am I affected, and how do I check?
MongoDB Server versions before 8.2.3, 8.0.17, 7.0.28, 6.0.27, 5.0.32, and 4.4.30 are in scope, within the 4.4, 5.0, 6.0, 7.0, 8.0, and 8.2 release lines. Only deployments with zlib compression enabled for network messages are described, so check the networkMessageCompressors or net.compression.compressors setting and the output of mongod --version.Source: jira.mongodb.org
What should I do about it?
Upgrade to 8.2.3, 8.0.17, 7.0.28, 6.0.27, 5.0.32, or 4.4.30, matching the release line in use. Until the upgrade is done, start mongod or mongos with networkMessageCompressors or net.compression.compressors set to omit zlib.Source: jira.mongodb.org
Is it being exploited?
Yes. CISA added it to its Known Exploited Vulnerabilities catalog on 2025-12-29, which means it has evidence of attacks. No public exploit code is tracked.Source: cisa.gov, cve.now feed data