CVE-2025-14847 | Teknoloji dünyasından en güncel haberleri ve güvenlikle ilgili gelişmeleri takip edin.

Mismatched length fields in Zlib compressed protocol headers may allow a read of uninitialized heap memory by an unauthenticated client. This issue affects all…
High KEV CVSS: 8.7

CVE-2025-14847

Mismatched length fields in Zlib compressed protocol headers may allow a read of uninitialized heap memory by an unauthenticated client. This issue affects all MongoDB Server v7.0 prior to 7.0.28 versions, MongoDB Server v8.0 versions prior to 8.0.17, MongoDB Server v8.2 versions prior to 8.2.3, MongoDB Server v6.0 versions prior to 6.0.27, MongoDB Server v5.0 versions prior to 5.0.32, MongoDB Server v4.4 versions prior to 4.4.30, MongoDB Server v4.2 versions greater than or equal to 4.2.0, MongoDB Server v4.0 versions greater than or equal to 4.0.0, and MongoDB Server v3.6 versions greater than or equal to 3.6.0.
Vendor
Mongodb
Product
Mongodb
CWE
CWE-130
Yayın Tarihi
2025-12-19 11:15:49
Güncelleme
2026-01-13 22:24:20
Source Identifier
cna@mongodb.com
KEV Date Added
2025-12-29

Kategoriler

CWE-130 Mongodb HIGH Mongodb 2025

Referanslar

https://jira.mongodb.org/browse/SERVER-115508 http://www.openwall.com/lists/oss-security/2025/12/29/21 https://www.smartkeyss.com/post/mongobleed-pre-auth-memory-disclosure-via-op_compressed-in-mongodb-cve-2025-14847 https://www.vicarius.io/vsociety/posts/cve-2025-14847-detection-script-heap-memory-exposure-in-mongodb-server https://www.vicarius.io/vsociety/posts/cve-2025-14847-mitigation-script-heap-memory-exposure-in-mongodb-server https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-14847