CVE-2025-14847

MongoDB and MongoDB Server Improper Handling of Length Parameter Inconsistency Vulnerability

7.5

CVSS

83.0%

EPSS (exploit prob.)

99.6%

EPSS percentile

Yes

Actively exploited

Ransomware use

2025-12-29

Added

Summary

MongoDB Server contains an improper handling of length parameter inconsistency vulnerability in Zlib compressed protocol headers. This vulnerability may allow a read of uninitialized heap memory by an unauthenticated client.

Affected software

Vendor: MongoDB · Product: MongoDB and MongoDB Server

Weakness types (CWE):

What to do

This vulnerability appears in CISA's Known Exploited Vulnerabilities catalog, meaning it is being exploited in the wild. Prioritize patching affected systems and verify exposure across your estate.

Related vulnerabilities in MongoDB

CVE	Name	EPSS	Exploited
CVE-2019-10758	MongoDB mongo-express Remote Code Execution Vulnerability	84.8%	Yes

Is your domain exposed?

Run a free, instant security report for any domain — exposure score, email auth, TLS and breach metadata.

Get your free report

All information is aggregated from public sources for awareness only and does not constitute an accusation or a security assessment. No personal data or credentials are published.