CVE-2025-14847
MongoDB and MongoDB Server Improper Handling of Length Parameter Inconsistency Vulnerability
Description
CVE-2025-14847 is a high-severity information disclosure vulnerability (CVSS 7.5) in MongoDB Server that allows an unauthenticated remote attacker to read uninitialized heap memory by exploiting mismatched length fields in Zlib-compressed protocol headers. This vulnerability, sometimes called "MongoBleed," affects a wide range of MongoDB Server versions including 5.0 through 8.2 branches. It is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog with a remediation deadline of January 19, 2026, and has an EPSS score of 0.64807 (98.4th percentile), indicating very high exploitation probability. Ransomware association is currently unknown.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NOpen in CalculatorCWEs
Affected Products
| Vendor | Product | Version |
|---|---|---|
| mongodb | mongodb | >= 3.6.0, < 4.4.30; >= 5.0.0, < 5.0.32; >= 6.0.0, < 6.0.27; >= 7.0.0, < 7.0.28; >= 8.0.0, < 8.0.17; >= 8.2.0, < 8.2.3 |
References
- https://jira.mongodb.org/browse/SERVER-115508(Issue Tracking, Patch, Vendor Advisory)
- http://www.openwall.com/lists/oss-security/2025/12/29/21(Mailing List)
- https://www.smartkeyss.com/post/mongobleed-pre-auth-memory-disclosure-via-op_compressed-in-mongodb-cve-2025-14847(Technical Description, Third Party Advisory)
- https://www.vicarius.io/vsociety/posts/cve-2025-14847-detection-script-heap-memory-exposure-in-mongodb-server(Exploit, Third Party Advisory)
- https://www.vicarius.io/vsociety/posts/cve-2025-14847-mitigation-script-heap-memory-exposure-in-mongodb-server(Exploit, Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-14847(Third Party Advisory, US Government Resource)
Weakness Type
CWE-130: Improper Handling of Length Parameter Inconsistency
CWE-130 describes vulnerabilities where software receives a length parameter that is inconsistent with the actual size of the data, and fails to handle this discrepancy safely. In CVE-2025-14847, the MongoDB wire protocol handler for Zlib-compressed messages (OP_COMPRESSED) does not properly validate that the declared uncompressed length matches the actual data size. When these values are mismatched, the server allocates a buffer based on the declared length and decompresses into it, but then processes data beyond what was actually decompressed, reading uninitialized heap memory that may contain sensitive information from previous operations.
Impact Analysis
The business impact of CVE-2025-14847 is significant because MongoDB is one of the most widely deployed database systems in modern applications. Confidentiality is highly impacted as the vulnerability allows an unauthenticated attacker to read uninitialized heap memory from the MongoDB server process. This leaked memory can contain fragments of database queries, authentication credentials, session tokens, encryption keys, and actual database records from previous operations. Integrity and availability are not directly affected, but the disclosed information could enable further attacks against the database or application layer. The EPSS score of 0.64807 (98.4th percentile) reflects extremely high exploitation probability, with public exploit scripts and detailed technical write-ups available from SmartKeyss (dubbing it "MongoBleed") and Vicarius. The vulnerability is particularly concerning because it requires no authentication — any client that can connect to the MongoDB port can exploit it. Given that many MongoDB instances are inadvertently exposed to the internet, the attack surface is broad. While ransomware association is currently unknown, threat actors have historically targeted exposed MongoDB instances for data theft and extortion.
Exploit Maturity
CVE-2025-14847 has a highly mature exploit ecosystem. It is confirmed as actively exploited and listed in CISA's Known Exploited Vulnerabilities (KEV) catalog with a remediation due date of January 19, 2026. The EPSS score of 0.64807 (98.4th percentile) places it among the most likely vulnerabilities to see exploitation. Public exploit resources include detection scripts from Vicarius and mitigation scripts, as well as a detailed technical analysis from SmartKeyss that explains the full exploitation technique. The MongoDB JIRA ticket SERVER-115508 contains the official patch. The vulnerability was also discussed on the oss-security mailing list. The ransomware association is currently unknown, but the pre-authentication nature and the history of MongoDB instances being targeted for extortion campaigns make ransomware weaponization a realistic concern.
Remediation
- Upgrade MongoDB Server to the fixed version — Update to MongoDB 5.0.32, 6.0.27, 7.0.28, 8.0.17, or 8.2.3 (or later) depending on your major version branch. Consult the MongoDB JIRA ticket for specific version details.
- Restrict network access to MongoDB ports — Ensure that MongoDB's default port (27017) is not accessible from untrusted networks or the internet. Use firewalls, security groups, or network ACLs to limit access to only authorized application servers and administrators.
- Enable MongoDB authentication — While this vulnerability can be exploited pre-authentication, enabling and enforcing authentication adds defense-in-depth. Ensure that all MongoDB deployments require authentication and use strong credentials.
- Disable Zlib compression if not needed — If your applications do not rely on wire protocol compression, consider disabling the Zlib compressor in MongoDB's network configuration to eliminate the vulnerable code path until patching is complete.
- Audit for prior data exposure — If your MongoDB instance was accessible from untrusted networks before patching, investigate whether the vulnerability was exploited by reviewing connection logs for unusual compressed message patterns or unexpected client connections.
Technical Details
The CVSS v3.1 vector for CVE-2025-14847 is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, yielding a base score of 7.5 (High). Attack Vector (Network) means the vulnerability is exploitable remotely by connecting to the MongoDB wire protocol port. Attack Complexity (Low) indicates no special conditions are needed. Privileges Required (None) is critical — the attacker does not need any MongoDB credentials or authentication. User Interaction (None) means no legitimate user action is required. Scope (Unchanged) indicates the impact is contained within the MongoDB server process. Confidentiality (High) reflects the ability to read sensitive heap memory contents. Integrity (None) and Availability (None) mean no data modification or service disruption occurs directly. The technical mechanism targets the OP_COMPRESSED wire protocol message handling. When a MongoDB client sends a compressed message, it includes both the compressed data and a field declaring the expected uncompressed size. The vulnerability arises because the server trusts this declared uncompressed length without proper validation against the actual decompressed data size. By sending a message with a declared uncompressed length larger than the actual data, the server allocates a buffer of the declared size, decompresses the (smaller) actual data into it, and then processes the full buffer including the uninitialized portion. This uninitialized heap memory may contain remnants of previous operations such as query results, credentials, and other sensitive data — a classic Heartbleed-style memory disclosure attack.
Frequently Asked Questions
Why is CVE-2025-14847 called "MongoBleed"?
The nickname "MongoBleed" draws a parallel to the famous Heartbleed vulnerability in OpenSSL. Both vulnerabilities exploit a mismatch between declared and actual data lengths to read uninitialized memory, potentially disclosing sensitive information. In MongoDB's case, the mismatch occurs in Zlib-compressed wire protocol headers.
Can this vulnerability be exploited without authentication?
Yes, this is a pre-authentication vulnerability. Any client that can establish a TCP connection to the MongoDB port can send a malicious compressed message and read heap memory without providing any credentials, making internet-exposed instances especially vulnerable.
Which MongoDB versions are affected?
The vulnerability affects MongoDB Server versions 3.6.0 through 4.4.29, 5.0.0 through 5.0.31, 6.0.0 through 6.0.26, 7.0.0 through 7.0.27, 8.0.0 through 8.0.16, and 8.2.0 through 8.2.2. Fixed versions are 4.4.30, 5.0.32, 6.0.27, 7.0.28, 8.0.17, and 8.2.3.
What kind of data could be leaked?
The uninitialized heap memory could contain fragments of previous database operations, including query results, authentication credentials, session tokens, encryption keys, and application data. The exact contents depend on what the MongoDB process was handling prior to the exploited request.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.