New MongoDB Flaw Lets Unauthenticated Attackers Read Uninitialized Memory

A high-severity flaw in MongoDB, tracked as CVE-2025-14847 with a CVSS score of 8.7, could allow unauthenticated users to read uninitialized heap memory by exploiting mismatches in length fields within Zlib compressed protocol headers. According to CVE[.]org, the issue arises when a length field is inconsistent with the actual data length, enabling a read of uninitialised memory by an unauthenticated client.

The vulnerability affects MongoDB versions 8.2.0 through 8.2.3, 8.0.0 through 8.0.16, 7.0.0 through 7.0.26, 6.0.0 through 6.0.26, 5.0.0 through 5.0.31, 4.4.0 through 4.4.29, all MongoDB Server v4.2, and all MongoDB Server v4.0 versions, as well as v3.6. The issue has been addressed in fixed releases including 8.2.3, 8.0.17, 7.0.28, 6.0.27, 5.0.32 and 4.4.30, MongoDB said.

If an immediate update is not possible, the article recommends disabling zlib compression by starting mongod or mongos with networkMessageCompressors or net.compression.compressors options that omit zlib.