CVE•Published 2025-12-19•2 articles on news•7 live references•NVD data

CVE-2025-14847

Vulnerability data via CVEDB (Shodan)

CVSS v3.1

8.7

HIGH

EPSS percentile

100

Exploit Prediction Scoring System · top 0% of all CVEs

Description

Mismatched length fields in Zlib compressed protocol headers may allow a read of uninitialized heap memory by an unauthenticated client. This issue affects all MongoDB Server v7.0 prior to 7.0.28 versions, MongoDB Server v8.0 versions prior to 8.0.17, MongoDB Server v8.2 versions prior to 8.2.3, MongoDB Server v6.0 versions prior to 6.0.27, MongoDB Server v5.0 versions prior to 5.0.32, MongoDB Server v4.4 versions prior to 4.4.30, MongoDB Server v4.2 versions greater than or equal to 4.2.0, MongoDB Server v4.0 versions greater than or equal to 4.0.0, and MongoDB Server v3.6 versions greater than or equal to 3.6.0.

Timeline

Published 2025-12-19

External references

NVD MITRE Exploit-DB GitHub PoC Sploitus trickest/cve VulnCheck

Search for exposed instances

Shodan + Censys queries derived from NVD's CPE data. The vuln tag catches assets Shodan has explicitly linked to this CVE; the product / banner fingerprints find exposed instances even when the vuln tag was never applied (which is common).

Shodan · vuln tag34,858 hosts

vuln:CVE-2025-14847

Hosts Shodan has explicitly fingerprinted as vulnerable.

Shodan · product + version

product:"Mongodb Mongodb" version:"3.6.0"

Version-pinned fingerprint from NVD's first vulnerable CPE.

Shodan · banner/body mention

http.html:"Mongodb"

HTTP body or banner mentions "Mongodb" — catches deploys Shodan didn't identify as a product.

More intel sources (5)

Shodan report

vuln:CVE-2025-14847