Replace 12/26/25: Article up to date to appropriate that the flaw has not been formally categorised as an RCE.
MongoDB has warned IT admins to instantly patch a high-severity memory-read vulnerability that could be exploited by unauthenticated attackers remotely.
Tracked as CVE-2025-14847, the security flaw impacts a number of MongoDB and MongoDB Server variations and could also be abused by unauthenticated risk actors in low-complexity assaults that do not require person interplay.
“An client-side exploit of the Server’s zlib implementation can return uninitialized heap reminiscence with out authenticating to the server. We strongly suggest upgrading to a hard and fast model as quickly as doable,” MongoDB’s security workforce mentioned in a Friday advisory.
“We strongly recommend you improve instantly. When you can not improve instantly, disable zlib compression on the MongoDB Server by beginning mongod or mongos with a networkMessageCompressors or a web.compression.compressors choice that explicitly omits zlib.”
CVE-2025-14847 is because of an improper dealing with of size parameter inconsistency, which in line with the related CWE-130 classification, may probably permit attackers to execute arbitrary code and probably achieve management of focused gadgets in some circumstances.
To patch the security flaw and block potential assaults, admins are suggested to instantly improve to MongoDB 8.2.3, 8.0.17, 7.0.28, 6.0.27, 5.0.32, or 4.4.30.
The vulnerability impacts the next MongoDB variations:
- MongoDB 8.2.0 via 8.2.3
- MongoDB 8.0.0 via 8.0.16
- MongoDB 7.0.0 via 7.0.26
- MongoDB 6.0.0 via 6.0.26
- MongoDB 5.0.0 via 5.0.31
- MongoDB 4.4.0 via 4.4.29
- All MongoDB Server v4.2 variations
- All MongoDB Server v4.0 variations
- All MongoDB Server v3.6 variations
The U.S. Cybersecurity and Infrastructure Safety Company (CISA) added a MongoDB mongo-express RCE flaw (CVE-2019-10758) to its catalog of identified exploited vulnerabilities 4 years in the past, tagging it as actively exploited and ordering federal companies to safe their programs, as mandated by Binding Operational Directive (BOD) 22-01.
MongoDB is a well-liked non-relational database administration system (DBMS) that, not like relational databases comparable to PostgreSQL and MySQL, shops knowledge in BSON (Binary JSON) paperwork as an alternative of tables.
The database software program is utilized by greater than 62,500 clients worldwide, together with dozens of Fortune 500 corporations.
Damaged IAM is not simply an IT drawback – the impression ripples throughout your complete enterprise.
This sensible information covers why conventional IAM practices fail to maintain up with fashionable calls for, examples of what “good” IAM seems to be like, and a easy guidelines for constructing a scalable technique.
