Exploited vulnerabilitiesOn CISA KEV
MongoBleed (CVE-2025-14847)
zlib-compressed message handling leaks uninitialized heap memory without authentication.
- Disclosed
- Verification
- Public record
What happened
- zlib-compressed message handling leaks uninitialized heap memory without authentication.
- Fixed: 8.2.3, 8.0.17, 7.0.28, 6.0.27 and others. KEV: 29 Dec 2025. Public PoC. Tens of thousands of exposed servers.
Am I affected?
CVE-2025-14847: MongoDB and MongoDB Server Improper Handling of Length Parameter Inconsistency Vulnerability
| Product | Affected | Not affected |
|---|---|---|
| MongoDB Inc. MongoDB Server | from 8.2 before 8.2.3 from 8.0 before 8.0.17 from 7.0 before 7.0.28 from 6.0 before 6.0.27 | Not stated |
- Fixed in: 8.2.3, 8.0.17, 7.0.28, 6.0.27, 5.0.32 (versions before these are affected).
- Exploited: yes, on CISA’s Known Exploited Vulnerabilities list since 29 Dec 2025; CISA’s deadline for US agencies was 19 Jan 2026.
- Detection: free a Nuclei template and a Suricata rule from vedas-signatures, explained on the CVE-2025-14847 page.
What to do now
- upgrade, or disable zlib network compression.
- For CVE-2025-14847, upgrade to 8.2.3, 8.0.17, 7.0.28, 6.0.27 or later.
Live scores
Live scores
CVE-2025-14847- EPSS
- 0.832
very likely to be attacked soon - VEDAS
- 0.987
strong exploit evidence - On CISA KEV
- Yes, since 2025-12-29
Thin horizontal line: the “likely” (EPSS 0.10) or “strong” (VEDAS 0.90) threshold. Shaded “no data” areas are periods when cve-scores did not publish. The vertical line is the day CISA added it to its exploited list.