CVE-2025-14847
Published: December 29, 2025
Official Description
MongoDB Server contains an improper handling of length parameter inconsistency vulnerability in Zlib compressed protocol headers. This vulnerability may allow a read of uninitialized heap memory by an unauthenticated client.
CISA KEV Advisory
MongoDB and MongoDB Server Improper Handling of Length Parameter Inconsistency Vulnerability
MongoDB Server contains an improper handling of length parameter inconsistency vulnerability in Zlib compressed protocol headers. This vulnerability may allow a read of uninitialized heap memory by an unauthenticated client.
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Risk Analysis
MongoDB Server contains a vulnerability where improper handling of length parameters in Zlib compressed protocol headers can lead to a read of uninitialized heap memory by an unauthenticated client. With a CVSS score of 7.5 (High) and an EPSS score of 0.64807, combined with confirmed in-the-wild exploitation, this flaw is critical due to potential information disclosure.
This vulnerability is actively exploited in the wild and is listed in CISA's KEV catalog. The CVSS vector indicates it is remotely exploitable (AV:N) without authentication (PR:N) and with low attack complexity (AC:L).
Apply the latest security patches for MongoDB Server to address the Zlib compression header vulnerability. Restrict network access to MongoDB instances to trusted clients only.
Technical Analysis
CVE-2025-14847 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.
The vulnerability requires no privileges and no user interaction, making it a prime target for automated exploitation campaigns and worm-like propagation.
A successful exploit results in complete confidentiality breach (data exposure), with a CVSS base score of 7.5.
CISA has added CVE-2025-14847 to the Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation in the wild. U.S. federal agencies are required to patch this within the mandated timeframe, and all organizations should treat remediation as urgent.
CVSS v3.1 Vector Breakdown
Exploit & PoC Resources
All References (1)
Quick Facts
Recommended Actions
- →Apply vendor patches immediately
- →Monitor CVE-2025-14847 in threat intel feeds
- →Review IDS/IPS signatures for exploitation attempts
- !CISA KEV: Federal agencies must patch per BOD 22-01 timeline
- !Active exploitation confirmed — treat as P1