MongoDB Server - Information Disclosure (MongoBleed)
CVE-2025-14847
Verified
Description
MongoDB Server contained a flaw in the zlib decompression logic where mismatched length fields in compressed protocol headers allowed a read of uninitialized heap memory by an unauthenticated client.
Severity
High
CVSS Score
7.5
Exploit Probability
83%
Affected Product
mongodb
Published Date
September 7, 2026
Template Author
pussycat0x, joe-desimone, dhiyaneshdk
+2
CVE-2025-14847.yaml
7.5Score
CVSS Metrics
CVSS Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVE ID:
cve-2025-14847
CWE ID:
cwe-908
Remediation Steps
Update to versions 8.2.3, 8.0.17, 7.0.28, 6.0.27, 5.0.32, or 4.4.30. Alternatively, disable zlib compression using snappy,zstd or disabled.