CVE-2025-14847

Name of the Vulnerable Software and Affected Versions MongoDB Server versions prior to 8.2.3 MongoDB Server versions prior to 8.0.17 MongoDB Server versions prior to 7.0.28 MongoDB Server versions prior to 6.0.27 MongoDB Server versions prior to 5.0.32 MongoDB Server versions prior to 4.4.30 MongoDB Server versions 3.6.0 through 4.2.x

Description An issue in the decompression logic of zlib-compressed network messages allows an unauthenticated remote attacker to read uninitialized heap memory. The flaw occurs because the server incorrectly handles length parameters in protocol headers, returning the size of the allocated memory buffer instead of the actual length of the decompressed data. By sending specially crafted malformed packets, an attacker can extract sensitive information from the server's memory, such as plaintext database passwords, API keys, session tokens, and cloud service credentials. Approximately 87,000 internet-exposed MongoDB servers are estimated to be potentially vulnerable, with 42% of cloud environments containing at least one affected instance. This issue has been actively exploited in the wild, including a reported breach of Ubisoft's Rainbow Six Siege services to manipulate in-game data and potentially access internal source code.

Recommendations Upgrade MongoDB Server to version 8.2.3 or newer. Upgrade MongoDB Server to version 8.0.17 or newer. Upgrade MongoDB Server to version 7.0.28 or newer. Upgrade MongoDB Server to version 6.0.27 or newer. Upgrade MongoDB Server to version 5.0.32 or newer. Upgrade MongoDB Server to version 4.4.30 or newer. For versions 3.6 through 4.2, upgrade to a supported fixed version or isolate the instances using firewalls. As a temporary mitigation, disable zlib compression by setting net.compression.compressors to snappy,zstd or disabled in the configuration. Restrict access to the MongoDB server port (default 27017) using firewall rules or IP allow-listing to ensure it is not publicly accessible.