CVE entry · CVE-2025-14847
CVE-2025-14847: MongoDB and MongoDB Server Improper Handling of Length Parameter Inconsistency Vulnerability
MongoDB Server contains an improper handling of length parameter inconsistency vulnerability in Zlib compressed protocol headers. This vulnerability may allow a read of uninitialized heap memory by an unauthenticated client.
- Actively exploited: added to CISA’s KEV catalog on December 29, 2025.
- Use by ransomware: not established so far.
- Remediation deadline for US federal agencies: January 19, 2026.
Description from CISA’s KEV catalog.
What to do
- Check whether your estate includes MongoDB and MongoDB Server, including internet-facing devices.
- Apply the vendor’s patch or mitigations (references below). Failing that, isolate the product or stop using it, as CISA requires of US federal agencies.
- An exploited vulnerability has often been used before it was fixed: look for signs of compromise, especially on internet-facing devices.