Critical Unauthenticated MongoDB Flaw Leaks Sensitive Data via zlib Compression

A critical unauthenticated vulnerability in MongoDB, tracked as CVE-2025-14847, allows attackers to siphon sensitive data from the server’s memory without logging in, according to the advisory. With a CVSSv4 score of 8.7, the flaw is rated High Severity and threatens unpatched deployments, since exploitation requires no authentication.

The issue stems from how the MongoDB Server handles data compression, specifically the zlib library implementation, enabling a memory leak or information disclosure by sending a crafted request that returns data chunks from the server’s heap. The vulnerability affects a wide range of versions, from 4.0 to 8.2 across multiple maintenance lines, and fixed versions are provided for supported branches: 8.2.3, 8.0.17, 7.0.28, 6.0.27, 5.0.32 and 4.4.30, with administrators urged to upgrade immediately.

If upgrading is not possible, the advisory recommends disabling zlib compression by starting mongod or mongos with a net.compression.compressors option that omits zlib, with safe alternatives including snappy or zstd.