CVE-2025-14847
Description
CVE-2025-14847 is a high-severity heap memory read vulnerability in MongoDB Server. Active exploitation reported; update to patched versions immediately.
CPE
| Product | Version Start | Version End (excl.) | Status |
|---|---|---|---|
| mongodb | 3.6.0 | 4.4.30 | vulnerable |
| mongodb | 5.0.0 | 5.0.32 | vulnerable |
| mongodb | 6.0.0 | 6.0.27 | vulnerable |
| mongodb | 7.0.0 | 7.0.28 | vulnerable |
| mongodb | 8.0.0 | 8.0.17 | vulnerable |
| mongodb | 8.2.0 | 8.2.3 | vulnerable |
Related weakness (CWE)
Remediation plan
Apply official patches
Download and install the latest security updates provided by MongoDB for your specific release branch to address the Zlib header processing flaw.
Update affected systems
Upgrade MongoDB Server to versions 4.4.30, 5.0.32, 6.0.27, 7.0.28, 8.0.17, 8.2.3, or later to ensure the vulnerability is remediated across your infrastructure.
Restrict access
Use firewalls and network segmentation to ensure that MongoDB instances (typically port 27017) are not exposed to the public internet and are only accessible from trusted application servers.
Monitor for exploitation
Implement monitoring for anomalous network traffic targeting MongoDB ports, specifically looking for malformed wire protocol packets or repeated connection resets involving compressed headers.
Detection Guidance
Security teams should monitor network traffic for malformed MongoDB wire protocol messages that utilize Zlib compression. Specifically, look for packets where the declared length in the header does not match the actual payload size. Review MongoDB logs for unexpected mongod process crashes or 'mismatched length' errors. Intrusion Detection Systems (IDS) should be updated with signatures identifying invalid compression metadata in MongoDB traffic.