CVE-2025-14847: MongoDB and MongoDB Server Improper Handling of Length Parameter Inconsistency Vulnerability

MongoDB Server is affected by an improper handling of length parameter inconsistency vulnerability in its Zlib compressed protocol headers. An unauthenticated client may be able to read uninitialized heap memory. The issue is tracked as CVE-2025-14847 and is classified under CWE-130.

How it works

The weakness is an inconsistency in how length parameters are handled within Zlib compressed protocol headers. An attacker can send crafted compressed data that causes the server to read beyond intended boundaries into uninitialized heap memory.

This occurs before authentication completes, allowing the read by an unauthenticated remote client. No further exploit mechanics are documented in the available summary.

Am I affected? How to find it in your systems

MongoDB Server instances commonly run as backend database services in application stacks. Inventory all deployments of MongoDB and MongoDB Server, including those hosted on-premises or in cloud environments.

• Check running processes and configuration files for MongoDB binaries and zlib compression settings.
• Review network listeners on default and custom MongoDB ports.
• Confirm exact versions and enabled protocol features against the vendor advisory, as no specific version list is provided here.
• Monitor for unusual inbound connections that target compressed protocol paths; detailed exploitation indicators must be validated with vendor telemetry guidance.

How to remediate

Apply the vendor update referenced in the official advisory as the primary step. Follow all instructions supplied by MongoDB for the affected product versions.

• After patching, verify that Zlib compressed protocol handling has been corrected in test environments before production rollout.
• Apply applicable hardening for length-parameter handling in protocol implementations where configuration options exist.

If you can't patch immediately

Apply mitigations exactly as described in the vendor instructions. For cloud-hosted instances, follow any relevant BOD 22-01 guidance issued by CISA.

• Consider network segmentation to limit unauthenticated access to MongoDB listeners.
• Disable Zlib compression in protocol settings if the option is available and supported.
• Discontinue use of the affected product if no mitigations can be applied.

If your data may have been exposed

Memory disclosure vulnerabilities can contribute to later breaches when actively exploited. You can run a free exposure scan of your email addresses against known breach data to check for prior incidents.