CVE-2025-14847

KEV catalog · CISA Known Exploited Vulnerabilities

CVE-2025-14847 7.5

MongoDB · MongoDB and MongoDB Server · Added 2025-12-29 · Published 2025-12-19

3-Day Required PoC Available KEV Automatable Active Exploitation

Details

VulnerabilityMongoDB and MongoDB Server Improper Handling of Length Parameter Inconsistency Vulnerability

VendorMongoDB

ProductMongoDB and MongoDB Server

Date added2025-12-29

Due date2026-01-19

CISA catalogView on CISA KEV catalog

Required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

CWECWE-130

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Descriptions

KEV: MongoDB Server contains an improper handling of length parameter inconsistency vulnerability in Zlib compressed protocol headers. This vulnerability may allow a read of uninitialized heap memory by an unauthenticated client.

NVD: Mismatched length fields in Zlib compressed protocol headers may allow a read of uninitialized heap memory by an unauthenticated client. This issue affects all MongoDB Server v7.0 prior to 7.0.28 versions, MongoDB Server v8.0 versions prior to 8.0.17, MongoDB Server v8.2 versions prior to 8.2.3, MongoDB Server v6.0 versions prior to 6.0.27, MongoDB Server v5.0 versions prior to 5.0.32, MongoDB Server v4.4 versions prior to 4.4.30, MongoDB Server v4.2 versions greater than or equal to 4.2.0, MongoDB Server v4.0 versions greater than or equal to 4.0.0, and MongoDB Server v3.6 versions greater than or equal to 3.6.0.

Compliance SSVC + BOD 26-04

Automatableyes

Technical impactpartial

Exploitation statusactive

3-day qualifyingYes

Public timeline3 days

Non-public timeline14 days

Forensic (public)Not required

Forensic (non-public)Not required

Research metadata

Last researched2026-08-29 08:44 UTC

Wall time0.6s

Searches3

Component defaultyes

Sources https://nvd.nist.gov/vuln/detail/CVE-2025-14847
https://jira.mongodb.org/browse/SERVER-115508
https://github.com/joe-desimone/mongobleed
https://github.com/im-hanzou/mongobleed
https://github.com/joshuavanderpoll/CVE-2025-14847
https://github.com/franksec42/mongobleed-exploit-CVE-2025-14847
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-14847
https://www.wiz.io/blog/mongobleed-cve-2025-14847-exploited-in-the-wild-mongodb
https://www.vicarius.io/vsociety/posts/cve-2025-14847-detection-script-heap-memory-exposure-in-mongodb-server
https://www.smartkeyss.com/post/mongobleed-pre-auth-memory-disclosure-via-op_compressed-in-mongodb-cve-2025-14847
https://kudelskisecurity.com/research/cve-2025-14847-is-a-high-severity-memory-disclosure-vulnerability-in-mongodb-servers-handling-of-zlib-compressed-network-protocol-headers
https://www.upwind.io/feed/cve-2025-14847-mongodb-zlib-memory-disclosure
https://www.sentinelone.com/vulnerability-database/cve-2025-14847/
https://www.ox.security/blog/attackers-could-exploit-zlib-to-exfiltrate-data-cve-2025-14847/
https://www.mongodb.com/community/forums/t/important-mongodb-patch-available/332977

Hunting hypothesis agent

Hunt for unauthenticated clients sending many OP_COMPRESSED messages with inflated uncompressedSize to port 27017 — mongobleed probes BSON lengths 20–8192, leaking /proc/meminfo and WiredTiger config as field names from uninitialized heap.

Research details

ComponentZlibMessageCompressor::decompressData (message_compressor_zlib.cpp) - OP_COMPRESSED message handler in MongoDB Server wire protocol; the Zlib compressed protocol header parser trusts attacker-supplied uncompressedSize field

PreconditionsNo authentication required; network access to a MongoDB instance (default port 27017) with zlib compression enabled in server configuration (enabled by default); vulnerable version ranges: v8.2.0-8.2.2, v8.0.0-8.0.16, v7.0.0-7.0.27, v6.0.0-6.0.26, v5.0.0-5.0.31, v4.4.0-4.4.29, and all v4.2.x, v4.0.x, v3.6.x versions (EoL, no patches available) agent

DeliveryNetwork protocol exploitation — unauthenticated attacker sends a crafted OP_COMPRESSED message with an inflated uncompressedSize field to a MongoDB server over TCP port 27017; the ZlibMessageCompressor::decompressData() function allocates a buffer based on the attacker-supplied size, resulting in uninitialized heap memory being returned in the server response when BSON parsing reads beyond actual decompressed data

Public PoCyes

PoC URLs https://github.com/joe-desimone/mongobleed
https://github.com/im-hanzou/mongobleed
https://github.com/joshuavanderpoll/CVE-2025-14847
https://github.com/franksec42/mongobleed-exploit-CVE-2025-14847
https://www.vicarius.io/vsociety/posts/cve-2025-14847-detection-script-heap-memory-exposure-in-mongodb-server
https://www.vicarius.io/vsociety/posts/cve-2025-14847-mitigation-script-heap-memory-exposure-in-mongodb-server Third-party repos; verify before use.

Advisoryhttps://jira.mongodb.org/browse/SERVER-115508

Exploit notesCVSS attack complexity: LOW | HIGH severity (CVSS 7.5); also known as MongoBleed; exploitation observed in the wild within days of public PoC release; Wiz Research published Nuclei detection template; CISA KEV confirmed active exploitation; multiple public PoC exploit tools available

SummaryCVE-2025-14847 (MongoBleed) is an unauthenticated heap memory disclosure vulnerability in MongoDB Server's handling of Zlib-compressed network protocol headers (OP_COMPRESSED messages). The root cause is in ZlibMessageCompressor::decompressData() which trusts the attacker-supplied uncompressedSize field in the protocol header, allocating a buffer based on that inflated value while zlib decompresses a much smaller payload into the buffer start. The BSON parser then reads 'field names' from uninitialized heap memory beyond the actual decompressed data, returning sensitive memory fragments (credentials, API keys, system info) to the unauthenticated attacker. No authentication is required — only network access to the MongoDB port. Affects every MongoDB version from 3.6 through 8.2. Multiple public PoCs exist (mongobleed by Joe Desimone and others). Exploitation was observed in the wild shortly after public disclosure. Mitigation: upgrade to patched versions (4.4.30+, 5.0.32+, 6.0.27+, 7.0.28+, 8.0.17+, 8.2.3+) or disable zlib compression by setting networkMessageCompressors to snappy,zstd or disabled.

Tia coverage

First reported2026-07-02

When Tia's reporting first covered this CVE and whether a report claimed exploitation before the KEV listing. Lead-time deltas are measured from the exploitation report only — plain coverage is not exploitation intel. See the story links under Mentioned in for coverage detail.

Mentioned in

chocopoc-malware-targets-security-researchers-via-trojanized-poc

Record schema v1.0. Enrichment is research-grade, not a substitute for analyst review.