CVE-2025-14847: MongoDB Server Zlib Header Mismatch Heap Disclosure (KEV, "MongoBleed")

CVE-2025-14847 is an improper length-handling bug in how MongoDB Server decompresses Zlib-compressed wire-protocol messages: a mismatch between the declared and actual length fields lets an unauthenticated remote client make the server read past the intended buffer into uninitialized heap memory, potentially leaking fragments of sensitive in-memory data back to the client without any login required, and it has been added to CISA's KEV catalog.

CVE-2025-14847 is an improper handling of a length-parameter inconsistency (CWE-130) in MongoDB Server's network-message decompression path. NVD's description states: "Mismatched length fields in Zlib compressed protocol headers may allow a read of uninitialized heap memory by an unauthenticated client" (NVD). MongoDB's own engineering ticket for the fix frames it as the server returning uninitialized heap memory to a client without requiring authentication to the server first (MongoDB SERVER-115508).

NVD lists only a Secondary CVSS submission from MongoDB's own CNA (source [email protected]): CVSS v3.1 7.5 (HIGH), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, and a CVSS v4.0 score of 8.7. NVD's own vulnerability status is "Analyzed," but no NVD Primary CVSS metric has been published for this CVE as of this run, so per our indexing policy the 7.5 figure is labelled not NVD-confirmed and is attributed to MongoDB's CNA rather than NVD itself (NVD).

The issue affects every actively-tracked MongoDB Server release line: v3.6 through v4.4.29 (fixed 4.4.30), v5.0 before 5.0.32, v6.0 before 6.0.27, v7.0 before 7.0.28, v8.0 before 8.0.17, and v8.2 before 8.2.3 (NVD; MongoDB SERVER-115508). For deployments that cannot upgrade immediately, MongoDB's ticket documents a mitigation: disable the Zlib wire-protocol compressor (e.g. set networkMessageCompressors/net.compression.compressors to exclude zlib, such as snappy,zstd, or disable compression entirely) (MongoDB SERVER-115508).

CISA added CVE-2025-14847 to the Known Exploited Vulnerabilities (KEV) catalog on 2025-12-29, with a required-action due date of 2026-01-19; known ransomware-campaign use is listed as "Unknown" (catalog confirmed live this run, matched by exact cveID string against the raw KEV feed) (CISA KEV).

As of 2026-10-29, FIRST scores the probability of exploitation at 0.83218 (99.677th percentile) — unusually high for an unauthenticated information-disclosure bug rather than a direct RCE, consistent with the memory-disclosure technique (publicly nicknamed "MongoBleed" by independent researchers) being easy to script and scan for at scale (FIRST EPSS).

Any MongoDB Server instance below the fixed builds above — especially one reachable from untrusted networks — should be upgraded immediately, or have the Zlib compressor disabled as an interim mitigation; because the leaked heap memory can contain fragments of other clients' data or internal server state, operators should also treat any period of exposure as a potential confidentiality incident requiring review.

• Mismatched length fields in Zlib-compressed wire-protocol headers allow an unauthenticated client to trigger a read of uninitialized heap memory on MongoDB Server. — NVD
• Only a Secondary CVSS v3.1 score of 7.5 from MongoDB's own CNA is published (also CVSS v4.0 8.7); no NVD Primary metric exists as of this run. — NVD
• Affects MongoDB Server v3.6 through 4.4.29 (fixed 4.4.30), and v5.0/6.0/7.0/8.0/8.2 before their respective fixed builds (5.0.32, 6.0.27, 7.0.28, 8.0.17, 8.2.3); mitigation is to disable the Zlib compressor if upgrading is not immediately possible. — MongoDB SERVER-115508
• Added to the CISA KEV catalog on 2025-12-29, due date 2026-01-19; known ransomware-campaign use listed as Unknown. — CISA KEV
• EPSS score is 0.83218 (99.677th percentile) as of 2026-10-29. — FIRST EPSS