CVE-2025-14847
Zlib compressed protocol header length confusion may allow memory read
- Published
- Dec 19, 2025
- Updated
- Feb 26, 2026
- Assigning CNA
- mongodb
- Evidence observed
- Dec 29, 2025
Primary CVSS
nvd · CVSS 4.0
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XHigh · next 30 days
- Percentile
- 99.7%
- Model date
- Oct 17, 2026
EPSS is a statistical estimate, not a certainty or a measure of impact. Combine it with CVSS, KEV status, exposure and your environment.
CISA Known Exploited
This CVE appears in the CISA Known Exploited Vulnerabilities catalog.
Summary
Mismatched length fields in Zlib compressed protocol headers may allow a read of uninitialized heap memory by an unauthenticated client. This issue affects all MongoDB Server v7.0 prior to 7.0.28 versions, MongoDB Server v8.0 versions prior to 8.0.17, MongoDB Server v8.2 versions prior to 8.2.3, MongoDB Server v6.0 versions prior to 6.0.27, MongoDB Server v5.0 versions prior to 5.0.32, MongoDB Server v4.4 versions prior to 4.4.30, MongoDB Server v4.2 versions greater than or equal to 4.2.0, MongoDB Server v4.0 versions greater than or equal to 4.0.0, and MongoDB Server v3.6 versions greater than or equal to 3.6.0.
Sources
modules/auxiliary/scanner/mongodb/cve_2025_14847_mongobleed.rb
Metasploit Framework modulesDeclared conditions
- verification: check_declared($.auxiliary_scanner/mongodb/cve_2025_14847_mongobleed.check)
network/cves/2025/CVE-2025-14847.yaml
Nuclei TemplatesDeclared conditions
- network: tcp($.protocol_keys)
- verification: dsl,word($.matchers[*].type)
Detect exposed MongoDB instances and CVE-2025-14847 "MongoBleed" risks — Zero-Trust Python scanner
- CVE-2025-14847_ExpolitExploit
Exploit tool for CVE-2025-14847, a MongoDB memory disclosure vulnerability, enabling multi-threaded extraction of sensitive data and secrets from vulnerable instances.
- CVE-2025-14847_ExpolitExploit
a critical memory disclosure vulnerability in MongoDB's zlib compression handling. This tool allows security researchers to extract sensitive data from vulnerable MongoDB instances.
Functional proof-of-concept exploit for CVE-2025-14847 (MongoBleed), a pre-authentication heap memory disclosure vulnerability in MongoDB. Includes automated memory leak detection, pattern analysis, and Docker-based lab environment for authorized security testing and research.
Explot, Lab, Scanner - external and docker container, for SMongobleed-CVE-2025-14847 plus phoenix security uploader
CVE-2025-14847 MongoBleed - MongoDB Memory Leak Vulnerability PoC
- mongobleedExploit
CVE-2025-14847 PoC exploit for MongoDB heap memory disclosure
- CVE-2025-14847-MongoDBResearch
Educational research tool demonstrating CVE-2025-14847 memory disclosure in MongoDB's BSON decompression. Simulates bounds-checking failures and memory safety concepts for vulnerability analysis.
- mongobleedPoC
Proof-of-concept exploit for CVE-2025-14847, a MongoDB zlib decompression vulnerability that leaks uninitialized server memory via crafted BSON documents.
- CVE-2025-14847Exploit
CVE-2025-14847 (MongoBleed)
- cve-2025-14847Exploit
MongoBleed: CVE-2025-14847 Memory Leak Discovery Tool
CVE-2025-14847 | MongoBleed vulnerability proof of concept project
- CVE-2025-14847-MongoBleedInformational
Analysis and remediation guide for CVE-2025-14847 (MongoBleed), a MongoDB zlib compression memory disclosure. Includes detection indicators, mitigation steps, and patching guidance.
Go proof-of-concept exploit for CVE-2025-14847 (MongoBleed), a MongoDB memory disclosure vulnerability. Crafts malformed BSON documents to leak uninitialized server memory via error messages.
Exploit lab, docker and code scanner for mongobleed Vulnerability CVE-2025-14847 plus Phoenix Security Sync tools
- MongoBleedExploit
CVE-2025-14847 (MongoBleed) scanner and exploit tool. Unauthenticated MongoDB heap memory leak via zlib decompression. Detection, memory extraction, credential parsing, CIDR/batch scanning, Nuclei templates, and CTF lab included
Remake of CVE-2025-14847 MongoDB vulnerability demonstration
- CVE-2025-14847Informational
CVE-2025-14847
- mongobleed-scannerScanner
MongoDB CVE-2025-14847 Heap Memory Leak Scanner | OP_COMPRESSED zlib Vulnerability | Bug Bounty & Red Team Tool
Full automation check for CVE-2025-14847 MonogBleed- Finds origin IP and tests for exploit.
Academic proof-of-concept demonstrating CVE-2025-14847 for authorized security research.
MongoBleed (CVE-2025-14847) Lab & PoC : A complete educational environment to reproduce the critical unauthenticated memory leak in MongoDB. Includes a vulnerable Docker container with multi-database seeding (PII, API keys) and a Python exploit to demonstrate data extraction. Ideal for security research and awareness. 1-day analysis.
- CVE-2025-14847_ExpolitExploit
Exploit for CVE-2025-14847, providing targeted vulnerability exploitation for penetration testing and security assessment of affected systems.
- mongobleedScanner
golang test tool for mongobleed (cve-2025-14847)
This repo contains my python script version of CVE-2025-14847 (MongoBleed)
poc for CVE-2025-14847
- CVE-2025-14847Exploit
🛠 Exploit the CVE-2025-14847 vulnerability in MongoDB to disclose sensitive heap memory using a Python script that analyzes responses for new leaked data.
- sakthivel10q.github.ioExploit
🛠 Exploit the CVE-2025-14847 MongoDB vulnerability to reveal sensitive information through crafted zlib-compressed packets and real-time output.
- CVE-2025-14847-mongobleedExploit
CVE-2025-14847 mongobleed python file
- MongoBleed-CVE-2025-14847Scanner
MongoBleed CVE-2025-14847 Vulnerability Checker
- MongoDeepDiveExploit
Context-Aware Memory Leak Scanner & Exploit for CVE-2025-14847.
CVE-2025-14847 MongoDB Memory Leak Exploit
- mongobleedInformational
CVE-2025-14847 explaination and lab
- CVE-2025-14847Scanner
This script is used to identify MongoDB services that are network-exposed and allow unauthenticated protocol handshakes.
Responsible use
Use vulnerability information only on systems you own or are authorized to test. Kitploit links to public research metadata and does not store exploit code or malicious payloads.