All vulnerabilities
CVE-2025-14847

MongoDB and MongoDB Server Improper Handling of Length Parameter Inconsistency Vulnerability

MongoDB MongoDB and MongoDB ServerDatabases
Open in ThreatlineRecord JSON
CVSS
8.7High
ExploitationExploited in the wildAdded to KEV 29 Dec 2025CISA KEV
Exploit odds (EPSS)83.2%Chance of exploitation activity in the next 30 days, higher than 99% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in8.2.3Also 8.0.17, 7.0.28 and 3 moreCVE List
Federal deadline19 Jan 2026Remediation due date for US federal agenciesCISA KEV
CISA required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. CISA KEV

What fixes it

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Timeline

  1. 19 Dec 2025, 11:00 UTCPublishedCVE List
  2. 19 Dec 2025Exploit code publicMetasploit
  3. 29 Dec 2025Added to CISA KEVCISA KEV

Public exploit code and templates 2

  • Auxiliary moduleMongoDB Memory Disclosure (CVE-2025-14847) - Mongobleed 19 Dec 2025Metasploit
  • Scanner templateMongoDB Server - Information Disclosure (MongoBleed)Nuclei

Listed so defenders can prioritize. Threatline links to the source and does not host exploit code.

Description

MongoDB Server contains an improper handling of length parameter inconsistency vulnerability in Zlib compressed protocol headers. This vulnerability may allow a read of uninitialized heap memory by an unauthenticated client.

Text from CVE List

Affected versions 9

  • MongoDB Serveraffected: 8.2 before 8.2.3CVE List
  • MongoDB Serveraffected: 8.0 before 8.0.17CVE List
  • MongoDB Serveraffected: 7.0 before 7.0.28CVE List
  • MongoDB Serveraffected: 6.0 before 6.0.27CVE List
  • MongoDB Serveraffected: 5.0 before 5.0.32CVE List
  • MongoDB Serveraffected: 4.4 before 4.4.30CVE List
  • MongoDB Serveraffected: 4.2CVE List
  • MongoDB Serveraffected: 4.0CVE List
  • MongoDB Serveraffected: 3.6CVE List

References 6