MongoDB and MongoDB Server Improper Handling of Length Parameter Inconsistency Vulnerability

MongoDB MongoDB and MongoDB Server

MongoDB Server contains an improper handling of length parameter inconsistency vulnerability in Zlib compressed protocol headers. This vulnerability may allow a read of uninitialized heap memory by an unauthenticated client. Added to CISA KEV on 2025-12-29 (federal deadline 2026-01-19).

First seen: 29 Dec 2025
Last update: 29 Dec 2025, 12:00 UTC
Identifiers: CVE-2025-14847
Source: CISA KEV

Check this repository for exposure to one security incident from pwned.coffee. Report first, change nothing until I say so.

## MongoDB and MongoDB Server Improper Handling of Length Parameter Inconsistency Vulnerability
Severity: high, exploited in the wild. Patch status: patched.
Affected: MongoDB MongoDB and MongoDB Server
Ids: CVE-2025-14847

MongoDB Server contains an improper handling of length parameter inconsistency vulnerability in Zlib compressed protocol headers. This vulnerability may allow a read of uninitialized heap memory by an unauthenticated client. Added to CISA KEV on 2025-12-29 (federal deadline 2026-01-19).

## Steps
1. Search the repo, its CI and infra config for MongoDB MongoDB and MongoDB Server. If present, report the version in use and whether it's affected.

## Report
A table: file, product or package, version in use, affected yes/no, exact fix. Then anything a human has to check outside the repo.

If you have the pwned.coffee MCP server (https://pwned.coffee/mcp), call lookup_cve("CVE-2025-14847") for the latest, and check_repo with this repo's lockfiles, Dockerfiles and workflows for a full receipt.
Sources: https://nvd.nist.gov/vuln/detail/CVE-2025-14847
https://pwned.coffee/i/mongodb-and-mongodb-server-improper-handling-of-length-p-cve-2025-14847

Sources

NVD: CVE-2025-14847

Totalone hot coffee