CVE Vulnerability Advisory Database
Filter vulnerabilities by CVSS severity, active CISA KEV exploitation, and technology stack.
Showing 1โ1 of 1 advisories (Page 1/1)
2025-12-19
MongoDB Server Pre-Auth Heap Memory Disclosure via Zlib Compressed Protocol Header Length Mismatch (CVE-2025-14847)
[Affected Scope] All MongoDB Server versions v3.6+, v4.0+, v4.2+, and versions prior to v4.4.30, v5.0.32, v6.0.27, v7.0.28, v8.0.17, and v8.2.3
[Impact] An unauthenticated remote attacker can read uninitialized heap memory by sending crafted Zlib compressed protocol headers, potentially exposing highly sensitive system and session data
[Mitigation] Immediately upgrade MongoDB Server to the respective patched release versions (v4.4.30, v5.0.32, v6.0.27, v7.0.28, v8.0.17, v8.2.3, or later)