CVE-2025-14847 MongoDB — Exploit & Vulnerability Details HIGH

Parameter	Value
CVSS	7.5 (HIGH)
Affected Versions	3.6.0 — 8.2.3
Fixed In	4.4.30
Type	CWE-130
Vendor	MongoDB
Public PoC	Yes

Mismatched length fields in Zlib compressed protocol headers may allow a read of uninitialized heap memory by an unauthenticated client. This issue affects all MongoDB Server v7.0 prior to 7.0.28 versions, MongoDB Server v8.0 versions prior to 8.0.17, MongoDB Server v8.2 versions prior to 8.2.3, MongoDB Server v6.0 versions prior to 6.0.27, MongoDB Server v5.0 versions prior to 5.0.32, MongoDB Server v4.4 versions prior to 4.4.30, MongoDB Server v4.2 versions greater than or equal to 4.2.0, MongoDB Server v4.0 versions greater than or equal to 4.0.0, and MongoDB Server v3.6 versions greater than or equal to 3.6.0.

Attack Parameters

Attack Vector

Network

Can be exploited remotely

Attack Complexity

Low

Easy to exploit

Privileges Required

None

No privileges needed

User Interaction

None

No user interaction needed

Impact Assessment

Confidentiality

High

Complete data leak

Integrity

None

No data modification

Availability

None

No disruption

CVSS Vector v3.1

Weakness Type (CWE)

CWE-130

Vulnerable Products 6

Configuration	From (including)	Up to (excluding)
Mongodb Mongodb cpe:2.3:a:mongodb:mongodb::::::::	`3.6.0`	`4.4.30`
Mongodb Mongodb cpe:2.3:a:mongodb:mongodb::::::::	`5.0.0`	`5.0.32`
Mongodb Mongodb cpe:2.3:a:mongodb:mongodb:::::-:::*	`6.0.0`	`6.0.27`
Mongodb Mongodb cpe:2.3:a:mongodb:mongodb:::::-:::*	`7.0.0`	`7.0.28`
Mongodb Mongodb cpe:2.3:a:mongodb:mongodb:::::-:::*	`8.0.0`	`8.0.17`
Mongodb Mongodb cpe:2.3:a:mongodb:mongodb:::::-:::*	`8.2.0`	`8.2.3`