This report was translated by AI; nobody has reviewed the translation yet. Original language: Czech.

[TLP:CLEAR] MongoDB Server fixes a high-severity vulnerability

MongoDB Server versions 8.2.3, 8.0.17, 7.0.28, 6.0.27, 5.0.32 and 4.4.30 fix a high-severity, actively exploited vulnerability [1][2]. Fixes on MongoDB Atlas were applied automatically [3]. Among the most common Linux distributions, Ubuntu (releases focal 20.04 and bionic 18.04) is affected, for example [4]. Red Hat systems are not affected [5]. Gentoo tracks the vulnerability [6], and a fix is so far available upstream [7].

MongoDB Server - unauthorized memory read (CVE-2025-14847)
CVSS 8.7 (High)

An unauthenticated remote attacker can read potentially sensitive data from uninitialized server memory without authorization [8]. If an immediate update is not possible, the risk can be temporarily mitigated by disabling zlib compression, by starting mongod or mongos instances with the 'networkMessageCompressors' or 'net.compression.compressors' parameter specifically excluding zlib (e.g. snappy or zstd) [1]. A PoC is available at [9].

The vulnerability is present in product:

  • MongoDB Server; >=3.6, <=3.6.23; >=4.0, <=4.0.28; >=4.2, <=4.2.25; >=4.4, <4.4.30; >=5.0, <5.0.32; >=6.0, <6.0.27; >=7.0, <7.0.28; >=8.0, <8.0.17; >=8.2, <8.2.3;

CVSS: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

More information:

The vulnerability was publicly disclosed 19. 12. 2025.

By CESNET, z.s.p.o. Michaela Ručková on 30. 12. 2025.

CESNET, z.s.p.o. Logo