Secuno
ENNL
Book demo

CVE-2025-14847

MongoDB and MongoDB Server Improper Handling of Length Parameter Inconsistency

7.5 HIGHActively exploited (CISA KEV)Public exploitEPSS 83.2%
  1. Published19 Dec 2025
  2. Added to CISA KEV29 Dec 2025
  3. Remediation due19 Jan 2026
Actively exploited (CISA KEV)

MongoDB Server contains an improper handling of length parameter inconsistency vulnerability in Zlib compressed protocol headers. This vulnerability may allow a read of uninitialized heap memory by an unauthenticated client.

Added to KEV: 29 Dec 2025Federal remediation due: 19 Jan 2026

Description

Mismatched length fields in Zlib compressed protocol headers may allow a read of uninitialized heap memory by an unauthenticated client. This issue affects all MongoDB Server v7.0 prior to 7.0.28 versions, MongoDB Server v8.0 versions prior to 8.0.17, MongoDB Server v8.2 versions prior to 8.2.3, MongoDB Server v6.0 versions prior to 6.0.27, MongoDB Server v5.0 versions prior to 5.0.32, MongoDB Server v4.4 versions prior to 4.4.30, MongoDB Server v4.2 versions greater than or equal to 4.2.0, MongoDB Server v4.0 versions greater than or equal to 4.0.0, and MongoDB Server v3.6 versions greater than or equal to 3.6.0.

CVSS 3.1 breakdown

Attack vectorNetwork
Attack complexityLow
Privileges requiredNone
User interactionNone
ScopeUnchanged
ConfidentialityHigh
IntegrityNone
AvailabilityNone
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Affected products

Mongodb≥ 3.6.0 < 4.4.30 · ≥ 5.0.0 < 5.0.32 · ≥ 6.0.0 < 6.0.27 · ≥ 7.0.0 < 7.0.28

Remediation

Fixed in
Mongodb≥ 4.4.30

References

Related CVEs

Recent high-severity vulnerabilities sharing a weakness type.

CVE-2026-1093909.8
AnyDesk before 8.0.3 allows unauthenticated remote attackers to execute arbitrary code…
CVE-2026-580968.8
LcpDecodeConfig() did not validate the length of received endpoint discriminator…
CVE-2026-456158.2
mouse07410/asn1c is an ASN.1 compiler. In 1.4 and earlier, a memory safety…
CVE-2026-422169.1
OpenEXR provides the specification and reference implementation of the EXR file format,…
CVE-2026-431259.8
In the Linux kernel, the following vulnerability has been resolved: dlm: validate…
CVE-2026-355478.1
When processing the header of an incoming message, libnv failed to properly validate…

Frequently asked

Is CVE-2025-14847 being actively exploited?

Yes. CVE-2025-14847 is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added 29 Dec 2025.

How severe is CVE-2025-14847?

CVE-2025-14847 has a CVSS 3.1 base score of 7.5, rated high. EPSS estimates a 83.2% probability of exploitation.

Which products are affected by CVE-2025-14847?

Affected products include Mongodb.

How do I fix CVE-2025-14847?

Upgrade affected software to a fixed version, for example Mongodb 4.4.30 or later, then confirm no affected versions remain in your inventory.

How Secuno handles this

Secuno correlates vulnerabilities like CVE-2025-14847 against the real software inventory on every managed device, every day. Rather than a static severity, each match is scored in context: exploit availability, EPSS, the asset's exposure, and business criticality decide where it lands in the queue. Because it is on the CISA KEV list, Secuno flags any affected asset as top-priority automatically. If an affected version is present anywhere across your portfolio, it surfaces automatically with a prioritised remediation path.

See how prioritisation worksBook a demo

Get Patch this first every Monday

Five vulnerabilities that matter this week, ranked on real exploitation. Plain language, one email, no spam.

You can unsubscribe with one click from every issue. We handle your details as described in our privacy policy.

Data from the NVD, CISA KEV catalog and FIRST EPSS. CVSS 3.1 base score shown where available.