mongobleed: unauthenticated heap leak in mongodb's zlib path
A length-field bug in MongoDB's zlib-compressed protocol headers let any client that could reach the server read uninitialized heap memory without logging in.
- cve
- CVE-2025-14847
- cvss
- 8.7 (v4.0, MongoDB CNA); 7.5 (v3.1, MongoDB CNA)
- affected
- MongoDB Server 8.2.0–8.2.2, 8.0.0–8.0.16, 7.0.0–7.0.26, 6.0.0–6.0.26, 5.0.0–5.0.31, 4.4.0–4.4.29, all 4.2 / 4.0 / 3.6
- fixed in
- 8.2.3, 8.0.17, 7.0.28, 6.0.27, 5.0.32, 4.4.30
- exploited
- yes — added to CISA KEV 2025-12-29
- platforms
- self-managed MongoDB Community and Enterprise Advanced; Atlas patched by MongoDB
what happened
- MongoDB says its security engineering team detected the issue on 2025-12-12, finished patching the Atlas fleet on 2025-12-18 and published CVE-2025-14847 on 2025-12-19.[1]
- Mismatched length fields in zlib-compressed protocol headers may let an unauthenticated client read uninitialized heap memory.[3,2]
- MongoDB scored the flaw 8.7 under CVSS v4.0 and 7.5 under CVSS v3.1 (CWE-130).[3]
- Fixed releases are 8.2.3, 8.0.17, 7.0.28, 6.0.27, 5.0.32 and 4.4.30; every 4.2, 4.0 and 3.6 version is affected with no fix for those lines.[2,5]
- MongoDB says tens of thousands of Atlas customers and hundreds of thousands of Atlas instances were proactively patched; self-managed deployments must be patched by their owners.[1,6]
- Unit 42 reported that a working public proof-of-concept was published on GitHub on 2025-12-26; CISA added CVE-2025-14847 to its KEV catalog on 2025-12-29 with a 2026-01-19 due date.[6,4]
- Palo Alto Networks Unit 42 said its Cortex Xpanse tool identified approximately 146,000 MongoDB instances exposed to the internet.[6]
where sources differMongoDB's Jira ticket lists 7.0.0–7.0.26 as affected while the Canadian Centre for Cyber Security lists 7.0.0–7.0.27; both give 7.0.28 as the fix. Unit 42's post still calls the ~146,000 instances "vulnerable" in one paragraph, although its 2026-01-14 update note says the word was removed; we use "exposed".
sources6
- 01MongoDB Server Security Update, December 2025 ↗ primaryMongoDBaccessed 2026-10-21
- 02SERVER-115508: Make minimally sized buffers for uncompressed Messages ↗ primaryMongoDBaccessed 2026-10-21
- 03NVD CVE API record for CVE-2025-14847 ↗ primaryNIST NVDaccessed 2026-10-21
- 04CISA Catalog of Known Exploited Vulnerabilities (JSON feed, catalogVersion 2026.10.21) ↗ primaryCISAaccessed 2026-10-21
- 05AL25-021 - Vulnerability affecting MongoDB - CVE-2025-14847 ↗ primaryCanadian Centre for Cyber Securityaccessed 2026-10-21
- 06MongoBleed (CVE-2025-14847) ↗ secondaryPalo Alto Networks Unit 42accessed 2026-10-21