8.7

CVE-2025-14847: MongoDB and MongoDB Server Improper Handling of Length Parameter Inconsistency Vulnerability

CVSS: 8.7v4.0HighKEVAnalyzed
AliasesUBUNTU-CVE-2025-14847USN-8160-1CGA-2qgf-cvfp-9w3p
Published 19-12-2025Last modified 26-02-2026
Open JSON

Vulnerability summary

CVE-2025-14847 is a high (CVSS 8.7) vulnerability in MongoDB MongoDB and MongoDB Server. It is known to be exploited: CISA lists it, first on 29-12-2025. EPSS estimates a 83.22% chance of exploitation in the next 30 days, higher than 99.6% of scored vulnerabilities. 3 public exploits are recorded.

Overall risk
85/100
0100
Critical · default modelHow is this calculated?
CVSS score
8.7/10
010
High · v4.0 (CVE.org)
EPSS score
83.22%
0%100%
Critical · 0.00 pp in 30 days
KEVListedCISA
RansomwareNone recordedNo known use recorded
Public exploits3reference, metasploit

Advisory lineage

Upstream 0 · Downstream 0 · Related 3
CGA-37J8-H929-W75QCGA-Q55V-F2J5-6X2QCGA-R8X7-2648-724G

Timeline

  1. 19-12-2025
    PublishedVulnerability first disclosed.
  2. 29-12-2025
    Added to CISA KEVMongoDB and MongoDB Server Improper Handling of Length Parameter Inconsistency Vulnerability
  3. 19-01-2026
    CISA remediation dueApply mitigations per vendor instructions.
  4. 26-02-2026
    Last modifiedVulnerability information updated.

Description

Mismatched length fields in Zlib compressed protocol headers may allow a read of uninitialized heap memory by an unauthenticated client. This issue affects all MongoDB Server v7.0 prior to 7.0.28 versions, MongoDB Server v8.0 versions prior to 8.0.17, MongoDB Server v8.2 versions prior to 8.2.3, MongoDB Server v6.0 versions prior to 6.0.27, MongoDB Server v5.0 versions prior to 5.0.32, MongoDB Server v4.4 versions prior to 4.4.30, MongoDB Server v4.2 versions greater than or equal to 4.2.0, MongoDB Server v4.0 versions greater than or equal to 4.0.0, and MongoDB Server v3.6 versions greater than or equal to 3.6.0.

CVSS metrics

7 scores · 4 sources · 2 versions

EPSS trend

Probability

83.22%

Chance of exploitation in the next 30 days

Percentile

100%

Versus all other CVEs

30-day change

0.00 pp

From 83.22% on 19-09-2026

19-09-202619-10-2026
EPSS score
83.22%

Known exploited

Compare KEV catalogs
CISA KEVListed
Added
29-12-2025
Federal due date
19-01-2026

CISA required action

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. nvd.nist.gov/vuln/detail/CVE-2025-14847

Public exploits

3 found
  • referenceUnverified

    Exploit Reference (vicarius.io)

    Maturity: unknown

  • referenceUnverified

    Exploit Reference (vicarius.io)

    Maturity: unknown

  • MetasploitMetasploitremoteUnverified

    MongoDB Memory Disclosure (CVE-2025-14847) - Mongobleed

    auxiliary/scanner/mongodb/cve_2025_14847_mongobleed

    Maturity: poc

Weaknesses

CWE · root cause

Affected systems

Chainguard4 products
  • mongod-5.0< 5.0.32-r0
  • mongod-6.0< 6.0.27-r0
  • mongod-7.0< 7.0.28-r0
  • mongod-8.0< 8.0.17-r0
Mongodb1 product
  • mongodb≥ 3.6.0, < 4.4.30 | ≥ 5.0.0, < 5.0.32 | ≥ 6.0.0, < 6.0.27 | ≥ 7.0.0, < 7.0.28 | ≥ 8.0.0, < 8.0.17 | ≥ 8.2.0, < 8.2.3
Mongodb inc1 product
  • mongodb server≥ 8.2, < 8.2.3 | ≥ 8.0, < 8.0.17 | ≥ 7.0, < 7.0.28 | ≥ 6.0, < 6.0.27 | ≥ 5.0, < 5.0.32 | ≥ 4.4, < 4.4.30 | 4.2 | 4.0 | 3.6
Ubuntu1 product
  • mongodb< 1:3.6.3-0ubuntu1.4+esm2 | < 1:3.6.9+really3.6.8+90~g8e540c0b6d-0ubuntu5.3+esm1

4 vendors · 7 products

References

12 links
Show all 12 references