CVE-2025-14847highunder attackCWE-130

CVE-2025-14847: high-severity vulnerability in MongoDB Server

Zlib compressed protocol header length confusion may allow memory read

Published · Updated

Follow this CVE+ Monitor MongoDB Server+ Monitor MongoDB

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

100Vexday Risk Score

Patch now. It under exploitation confirmed by CISA and has a working public exploit.

ssvc Actcvss 8.7epss 83%
from disclosure to weaponsame day
Published on NVDDec 19
1st PoCJul 30
metasploitDec 19
CISA KEV+10d
Action required by CISAfederal deadline: 2026-01-19

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

In short

MongoDB servers using Zlib compression have a flaw where mismatched header length fields allow unauthenticated attackers to read uninitialized memory from the server. This could expose sensitive data without requiring authentication.

Technical detail

The vulnerability exists in Zlib compressed protocol header parsing where length field inconsistencies enable unauthenticated remote clients to trigger heap memory reads. An attacker can craft malformed compressed protocol messages to leak uninitialized heap memory contents, potentially exposing sensitive data; no authentication is required to trigger this condition.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

Mismatched length fields in Zlib compressed protocol headers may allow a read of uninitialized heap memory by an unauthenticated client. This issue affects all MongoDB Server v7.0 prior to 7.0.28 versions, MongoDB Server v8.0 versions prior to 8.0.17, MongoDB Server v8.2 versions prior to 8.2.3, MongoDB Server v6.0 versions prior to 6.0.27, MongoDB Server v5.0 versions prior to 5.0.32, MongoDB Server v4.4 versions prior to 4.4.30, MongoDB Server v4.2 versions greater than or equal to 4.2.0, MongoDB Server v4.0 versions greater than or equal to 4.0.0, and MongoDB Server v3.6 versions greater than or equal to 3.6.0.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Affected products
MongoDB Inc. · MongoDB Server
public PoCs found — 75
githubgithub.com/Black1hp/mongobleed-scanner★ 36githubgithub.com/cybertechajju/CVE-2025-14847_Expolit★ 31githubgithub.com/ProbiusOfficial/CVE-2025-14847★ 25githubgithub.com/onewinner/CVE-2025-14847★ 14githubgithub.com/Security-Phoenix-demo/mongobleed-exploit-CVE-2025-14847★ 13githubgithub.com/chinaxploiter/CVE-2025-14847-PoC★ 4githubgithub.com/joshuavanderpoll/CVE-2025-14847★ 3githubgithub.com/franksec42/mongobleed-exploit-CVE-2025-14847★ 3githubgithub.com/peakcyber-security/CVE-2025-14847★ 2githubgithub.com/nma-io/mongobleed★ 2githubgithub.com/alexcyberx/CVE-2025-14847_Expolit★ 2githubgithub.com/sakthivel10q/CVE-2025-14847★ 1githubgithub.com/lincemorado97/CVE-2025-14847★ 1githubgithub.com/FurkanKAYAPINAR/CVE-2025-14847-MongoBleed-Exploit★ 1githubgithub.com/NoNameError/MongoBLEED---CVE-2025-14847-POC-★ 1githubgithub.com/waheeb71/CVE-2025-14847★ 1githubgithub.com/CadGoose/MongoBleed-CVE-2025-14847-Fully-Automated-scanner★ 1githubgithub.com/AdolfBharath/mongobleed★ 1githubgithub.com/InfoSecAntara/CVE-2025-14847-MongoDB★ 1githubgithub.com/dawnsmithcyber/azure-vulnerability-remediation-project★ 1githubgithub.com/0xBlackash/CVE-2025-14847★ 0githubgithub.com/Systemhaus-Schulz/MongoBleed-CVE-2025-14847★ 0githubgithub.com/shokribardiya/CVE-2025-14847-mongobleed★ 0githubgithub.com/im-hanzou/mongobleed★ 0githubgithub.com/ElJoamy/MongoBleed-exploit★ 0githubgithub.com/sahar042/CVE-2025-14847★ 0githubgithub.com/saereya/CVE-2025-14847---MongoBleed★ 0githubgithub.com/KingHacker353/CVE-2025-14847_Expolit★ 0githubgithub.com/pedrocruz2202/mongobleed-scanner★ 0githubgithub.com/pedrocruz2202/pedrocruz2202.github.io★ 0githubgithub.com/sakthivel10q/sakthivel10q.github.io★ 0githubgithub.com/keraattin/Mongobleed-Detector-CVE-2025-14847★ 0githubgithub.com/amnnrth/CVE-2025-14847★ 0githubgithub.com/Rishi-kaul/CVE-2025-14847-MongoBleed★ 0githubgithub.com/14mb1v45h/CYBERDUDEBIVASH-MONGODB-DETECTOR-v2026★ 0githubgithub.com/kuyrathdaro/cve-2025-14847★ 0githubgithub.com/JemHadar/MongoBleed-DFIR-Triage-Script-CVE-2025-14847★ 0githubgithub.com/tunahantekeoglu/MongoDeepDive★ 0githubgithub.com/vfa-tuannt/CVE-2025-14847★ 0githubgithub.com/j0lt-github/mongobleedburp★ 0githubgithub.com/sho-luv/MongoBleed★ 0vulncheckvulncheck.com/xdb/91956412657dunverifiedvulncheckvulncheck.com/xdb/e36c882b2d40unverifiedvulncheckvulncheck.com/xdb/8e708050ef93unverifiedvulncheckvulncheck.com/xdb/ddb87b41e095unverifiedvulncheckvulncheck.com/xdb/e31e64b6b94dunverifiedvulncheckvulncheck.com/xdb/ca2660a74092unverifiedvulncheckvulncheck.com/xdb/7f5a8a61dceeunverifiedvulncheckvulncheck.com/xdb/8c5a46767f5dunverifiedvulncheckvulncheck.com/xdb/cc9776783586unverifiedvulncheckvulncheck.com/xdb/c72b6137f65cunverifiedvulncheckvulncheck.com/xdb/b4df1eeb4a8eunverifiedvulncheckvulncheck.com/xdb/4ef756de9b3funverifiedvulncheckvulncheck.com/xdb/7ccc79f37b95unverifiedvulncheckvulncheck.com/xdb/e3cc60307323unverifiedvulncheckvulncheck.com/xdb/5d99c938f82dunverifiedvulncheckvulncheck.com/xdb/5c0359da676bunverifiedvulncheckvulncheck.com/xdb/bcaf58f61476unverifiedvulncheckvulncheck.com/xdb/ce09e9307c7bunverifiedvulncheckvulncheck.com/xdb/c735cd3246ebunverifiedvulncheckvulncheck.com/xdb/09d5780d04cbunverifiedvulncheckvulncheck.com/xdb/02dd79a637aaunverifiedvulncheckvulncheck.com/xdb/c8e481b4aa15unverifiedvulncheckvulncheck.com/xdb/88bcfbcfa6fcunverifiedvulncheckvulncheck.com/xdb/fe706894a1a9unverifiedvulncheckvulncheck.com/xdb/52d82b1418a7unverifiedvulncheckvulncheck.com/xdb/7bec0bc91cd8unverifiedvulncheckvulncheck.com/xdb/d932733b46e3unverifiedvulncheckvulncheck.com/xdb/181477ab83b1unverifiedvulncheckvulncheck.com/xdb/a49c59c0e531unverifiedvulncheckvulncheck.com/xdb/db6becc2eb44unverifiedvulncheckvulncheck.com/xdb/f4566076abb2unverifiedvulncheckvulncheck.com/xdb/70d85c77436bunverifiedvulncheckvulncheck.com/xdb/a4c0f261204funverifiedvulncheckvulncheck.com/xdb/7ad9d08496b2unverified
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — MongoDB Server

In the same product, most dangerous first.

CVE-2021-32040MEDIUMLarge aggregation pipelines with a specific stage can crash mongod under default configurationEPSS 2.0%CVE-2020-7925HIGHDenial of Service when processing malformed Role namesEPSS 1.7%CVE-2019-20925HIGHDenial of service via malformed network packetEPSS 1.7%CVE-2018-20802MEDIUMPost-auth queries on compound index may crash mongodEPSS 1.6%CVE-2020-7928MEDIUMImproper neutralization of null byte leads to read overrunEPSS 1.4%CVE-2018-20803MEDIUMInfinite loop in aggregation expressionEPSS 1.4%