High-severity MongoDB flaw CVE-2025-14847 could lead to server takeover

MongoDB has addressed a high-severity vulnerability, tracked as CVE-2025-14847, which carries a CVSS score of 8.7 and could allow an unauthenticated, remote attacker to execute arbitrary code on vulnerable servers. The flaw is linked to a client-side exploit of the server’s zlib implementation that can return uninitialised heap memory without authenticating to the server.

The advisory urges organisations to upgrade to fixed versions immediately, and if upgrade is not possible, to disable zlib compression on the MongoDB server by starting mongod or mongos with either networkMessageCompressors or net.compression.compressors options that omit zlib; safe values include snappy, zstd or disabled.

The vulnerability affects multiple MongoDB versions, including 8.2.0 through 8.2.3, 8.0.0 through 8.0.16, 7.0.0 through 7.0.26, 6.0.0 through 6.0.26, 5.0.0 through 5.0.31, 4.4.0 through 4.4.29, and all MongoDB Server v4.2, v4.0, and v3.6 versions. Versions 8.2.3, 8.0.17, 7.0.28, 6.0.27, 5.0.32 and 4.4.30 address the flaw. MongoDB is a popular open-source NoSQL database that stores data as JSON-like documents in BSON format.