CVE-2025-14847: unauthorized memory read in MongoDB

CVE-2025-14847 is a vulnerability in the Zlib compression protocol used by MongoDB Server. Mismatched length fields in compressed protocol headers allow an unauthenticated client to read uninitialized heap memory, potentially exposing sensitive data stored in system buffers. The flaw affects every MongoDB version from v3.6 to v8.2, including the widely deployed Long-Term Support versions in production environments.

Severity is rated CVSS 7.5 (high) because no authentication is required: any network client can send malformed headers to read memory. Patch status is available for all versions: MongoDB released specific fixes (7.0.28, 8.0.17, 8.2.3, 6.0.27, 5.0.32, 4.4.30 and later). Signals on GitHub show publicly available triage tools to identify exposed instances, confirming that the CVE is known in security communities.

In defense, administrators must verify which MongoDB version is in production and apply the corresponding update from the official list. Since no authentication is required, all exposed instances on the network are at risk: isolating MongoDB behind strict firewall rules remains recommended until patches are applied. Publicly available triage tools can confirm exposure without introducing further risk beyond the CVE itself.