CVE-2025-14847
Act now ● On CISA KEV — actively exploited
Actively exploited — on the CISA KEV list.
CVSS base
—
EPSS — probability of exploitation (30 days)
83.2%
99.7th percentile
CISA KEV
Listed
Added 2025-12-29 · patch by 2026-01-19
Weakness / dates
—
Published — · modified —
Description
MongoDB Server contains an improper handling of length parameter inconsistency vulnerability in Zlib compressed protocol headers. This vulnerability may allow a read of uninitialized heap memory by an unauthenticated client.