Detections
Analytics

CVE-2025-14847

high

Description

Mismatched length fields in Zlib compressed protocol headers may allow a read of uninitialized heap memory by an unauthenticated client. This issue affects all MongoDB Server v7.0 prior to 7.0.28 versions, MongoDB Server v8.0 versions prior to 8.0.17, MongoDB Server v8.2 versions prior to 8.2.3, MongoDB Server v6.0 versions prior to 6.0.27, MongoDB Server v5.0 versions prior to 5.0.32, MongoDB Server v4.4 versions prior to 4.4.30, MongoDB Server v4.2 versions greater than or equal to 4.2.0, MongoDB Server v4.0 versions greater than or equal to 4.0.0, and MongoDB Server v3.6 versions greater than or equal to 3.6.0.

From the Tenable Blog

MongoBleed CVE-2025-14847 exploited in the wild
MongoBleed CVE-2025-14847 exploited in the wild

Published: 2025-12-29

MongoBleed CVE-2025-14847 exploited in the wild

References

https://www.smartkeyss.com/post/mongobleed-pre-auth-memory-disclosure-via-op_compressed-in-mongodb-cve-2025-14847

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-14847

https://unit42.paloaltonetworks.com/mongobleed-cve-2025-14847/

https://thehackernews.com/2025/12/mongodb-vulnerability-cve-2025-14847.html

https://www.wiz.io/blog/mongobleed-cve-2025-14847-exploited-in-the-wild-mongodb

https://www.cisa.gov/news-events/ics-advisories/icsa-26-218-01

https://thehackernews.com/2026/07/new-chocopoc-rat-targets-vulnerability.html

https://thehackernews.com/2025/12/new-mongodb-flaw-lets-unauthenticated.html

https://securityaffairs.com/186107/security/high-severity-mongodb-flaw-cve-2025-14847-could-lead-to-server-takeover.html

https://www.bleepingcomputer.com/news/security/mongodb-warns-admins-to-patch-severe-vulnerability-immediately/

https://www.bleepingcomputer.com/news/security/mongodb-warns-admins-to-patch-severe-rce-flaw-immediately/

https://jira.mongodb.org/browse/SERVER-115508

https://www.tenable.com/blog/cve-2025-40602-sonicwall-secure-mobile-access-sma-1000-zero-day-exploited

https://github.com/hhhell/CVE-Vulnerability-Reproduction

https://github.com/Neverland-lcl/Security_OS_CVE

https://github.com/Neverland-lcl/Security_OS

https://github.com/shokribardiya/CVE-2025-14847-mongobleed

https://github.com/dawnsmithcyber/azure-vulnerability-remediation-project

https://github.com/Farenhytee/database-sentinel

https://github.com/p3Nt3st3r-sTAr/MajorDoMo-CVE-2026-27179

https://github.com/zaryouhashraf/CVE-2025-14847

https://github.com/0xAshwesker/CVE-2025-14847

https://github.com/FurkanKAYAPINAR/CVE-2026-24061-telnet2root

https://github.com/InfoSecAntara/CVE-2025-14847-MongoDB

https://github.com/sakthivel10q/sakthivel10q.github.io

https://github.com/pedrocruz2202/pedrocruz2202.github.io

https://github.com/pedrocruz2202/mongobleed-scanner

https://github.com/alexcyberx/CVE-2025-14847_Expolit

https://github.com/AdolfBharath/mongobleed

https://github.com/ctkqiang/CVE-Exploits

https://github.com/HackerTyperAbuser/CVE

https://github.com/hitori-chan/cvetrends-bot

https://github.com/CadGoose/MongoBleed-CVE-2025-14847-Fully-Automated-scanner

https://github.com/keraattin/Mongobleed-Detector-CVE-2025-14847

https://github.com/Ermensonx/CVE-2025-14857-MongoBleed

https://github.com/chinaxploiter/CVE-2026-21445-PoC

https://github.com/ElJoamy/MongoBleed-exploit

https://github.com/Systemhaus-Schulz/MongoBleed-CVE-2025-14847

https://github.com/Rishi-kaul/CVE-2025-14847-MongoBleed

https://github.com/chinaxploiter/CVE-2025-68645-PoC

https://github.com/j0lt-github/mongobleedburp

https://github.com/kuyrathdaro/cve-2025-14847

https://github.com/cybertechajju/CVE-2025-14847_Expolit

https://github.com/onewinner/CVE-2025-14847

https://github.com/tralsesec/AnatomyOfABug

http://www.openwall.com/lists/oss-security/2025/12/29/21

Details

Source: Mitre, NVD

Published: 2025-12-19

Updated: 2026-01-13

Named Vulnerability: mongobleedNamed Vulnerability: MongoBleedKnown Exploited Vulnerability (KEV)

Risk Information

CVSS v2

Base Score: 7.8

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:N/A:N

Severity: High

CVSS v3

Base Score: 7.5

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Severity: High

CVSS v4

Base Score: 8.7

Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Severity: High

EPSS

EPSS: 0.83218

Vulnerability Watch

Tenable Research has classified this CVE under the following Vulnerability Watch classification, which includes active and historical (inactive) classifications. You can learn more about these classifications on our blog.

Vulnerability of Interest