CVE-2025-14847, dubbed "MongoBleed," is a critical vulnerability affecting numerous MongoDB Server versions, where mismatched length fields in Zlib compressed protocol headers can lead to unauthenticated heap memory disclosure. With a CVSS score of 7.5 (High), this flaw allows an unauthenticated attacker to read sensitive information from memory without user interaction, posing a significant risk of data exposure. This vulnerability is actively exploited in the wild, with public exploit modules available (e.g., Metasploit), and has garnered extensive community discussion and media coverage, emphasizing the urgent need for patching.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
>= 3.6.0, < 4.4.30CPE matchmatch criteria | cpe:2.3:a:mongodb:mongodb:*:*:*:*:*:*:*:* | ||
>= 5.0.0, < 5.0.32CPE matchmatch criteria | cpe:2.3:a:mongodb:mongodb:*:*:*:*:*:*:*:* | ||
>= 6.0.0, < 6.0.27CPE matchmatch criteria | cpe:2.3:a:mongodb:mongodb:*:*:*:*:-:*:*:* | ||
>= 7.0.0, < 7.0.28CPE matchmatch criteria | cpe:2.3:a:mongodb:mongodb:*:*:*:*:-:*:*:* | ||
>= 8.0.0, < 8.0.17CPE matchmatch criteria | cpe:2.3:a:mongodb:mongodb:*:*:*:*:-:*:*:* |
CVSS version used by this source: 4.0
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.4 GitHub mentions.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
MongoBleed: MongoDB Memory Disclosure Vulnerability (CVE-2025-14847)
Feb 10, 2026MongoBleed: MongoDB Memory Disclosure Vulnerability (CVE-2025-14847)
Feb 10, 2026MongoBleed: MongoDB Memory Disclosure Vulnerability (CVE-2025-14847)
Feb 10, 2026MongoBleed: MongoDB Memory Disclosure Vulnerability (CVE-2025-14847)
Feb 10, 2026MongoBleed: MongoDB Memory Disclosure Vulnerability (CVE-2025-14847)
Feb 10, 2026MongoBleed: MongoDB Memory Disclosure Vulnerability (CVE-2025-14847)
Feb 10, 2026MongoBleed: MongoDB Memory Disclosure Vulnerability (CVE-2025-14847)
Feb 10, 2026MongoBleed: MongoDB Memory Disclosure Vulnerability (CVE-2025-14847)
Feb 10, 2026Security Advisory on Omada Controller Exposure to MongoBleed