UpHeron
All vulnerabilities

Servers and applications

CVE-2025-14847

Mismatched length fields in Zlib compressed protocol headers may allow a read of uninitialized heap memory by an unauthenticated client. This issue affects all MongoDB Server v7.0 prior to 7.0.28 versions, MongoDB Server v8.0 versions prior to 8.0.17, MongoDB Server v8.2 versions prior to 8.2.3, MongoDB Server v6.0 versions prior to 6.0.27, MongoDB Server v5.0 versions prior to 5.0.32, MongoDB…

Actively exploited: CISA added it to its Known Exploited Vulnerabilities catalog on 29 Dec 2025.

Severity
High 8.7
Published
19 Dec 2025
Last changed
17 Jun 2026
Added to UpHeron
21 Oct 2026
Fixed in
4.4.30, 5.0.32, 6.0.27, 7.0.28, 8.0.17, 8.2.3
Sources
NVD

Affected software

SoftwareAffected versions
MongoDBServers and applications · cpe:a:mongodb:mongodb
  • From 3.6.0 before 4.4.30
  • From 5.0.0 before 5.0.32
  • From 6.0.0 before 6.0.27
  • From 7.0.0 before 7.0.28
  • From 8.0.0 before 8.0.17
  • From 8.2.0 before 8.2.3

Known exploited

CISA name
MongoDB and MongoDB Server Improper Handling of Length Parameter Inconsistency Vulnerability
Required action
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Due for US agencies
19 Jan 2026
Used in ransomware
Not known

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2025-14847
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2025-14847