A serious security flaw has been identified in MongoDB, a popular NoSQL database used by thousands worldwide. The bug could let unauthenticated users access uninitialized memory on affected systems, potentially allowing them to run malicious code or take control of the database server. MongoDB has issued urgent guidance to users to update their software to protect their systems.

Details of the Vulnerability

The flaw is tracked as CVE-2025-14847 and involves mismatched length fields in zlib compressed protocol headers. This mismatch can cause the server to leak uninitialized heap memory, which could be exploited by attackers. The vulnerability is classified as high severity because of its potential impact on system security and stability.

The issue affects a wide range of MongoDB versions, including major releases from version 4.0 up to 8.2.3. Specifically, versions MongoDB 8.2.0 through 8.2.3, 8.0.0 through 8.0.16, 7.0.0 through 7.0.26, 6.0.0 through 6.0.26, 5.0.0 through 5.0.31, and 4.4.0 through 4.4.29 are vulnerable. Older versions such as 4.2 and 4.0 are also affected, along with all versions of MongoDB Server 3.6.

Recommended Actions for Users

MongoDB strongly urges users to update their systems immediately to the patched versions. The recommended versions include MongoDB 8.2.3, 8.0.17, 7.0.28, 6.0.27, 5.0.32, and 4.4.30. Applying these updates will fix the vulnerability and prevent potential exploits.

For users unable to update right away, MongoDB advises disabling zlib compression on the server. This can be done by starting the database with specific options that omit zlib compression, such as networkMessageCompressors or net.compression.compressors settings. This temporary measure can help mitigate the risk until a proper update is applied.

MongoDB remains one of the most popular NoSQL databases, serving over 62,000 customers worldwide, including 70% of the Fortune 100. Keeping software up-to-date is crucial to maintaining security and avoiding potential breaches caused by known vulnerabilities.

Inspired by

• https://www.infoworld.com/article/4111707/high-severity-flaw-in-mongodb-could-allow-memory-leakage.html

Sources

• mitre.org
• mongodb.org
• mongodb.com
• mongodb.com