Information Disclosure Vulnerability in MongoDB (CVE-2025-14847)

Overview On December 19, 2025, MongoDB disclosed information regarding a vulnerability (CVE-2025-14847) in MongoDB involving information disclosure from uninitialized heap memory. If exploited, an unauthenticated remote third party could send specially crafted communications to read information remaining in uninitialized heap memory, potentially leading to the leakage of confidential information (such as API keys and credentials) stored within MongoDB. Additionally, U.S. security firms such as Rapid7 and Resecurity have published blog posts detailing proof-of-concept (PoC) code for this vulnerability. While no confirmed exploitation of this vulnerability has been reported as of today, an increase in attacks leveraging PoC or similar exploits is a concern. We recommend reviewing the information below and implementing countermeasures promptly. Affected Products The affected products and versions are as follows. For details, please refer to MongoDB's information. MongoDB 8.2.0 through 8.2.2 MongoDB 8.0.0 through 8.0.16 MongoDB 7.0.0 through 7.0.26 MongoDB 6.0.0 through 6.0.26 MongoDB 5.0.0 through 5.0.31 MongoDB 4.4.0 through 4.4.29 All versions of MongoDB Server v4.2 All versions of MongoDB Server v4.0 All versions of MongoDB Server v3.6 Mitigation Update your product to a patched version based on information provided by the vendor. Note that some affected versions are no longer supported and may not have updates available. If updating is not possible, apply the workaround. Refer to the vendor's information for details. Additionally, if your MongoDB instance is directly accessible from the internet and this is unnecessary, we recommend reviewing your network configuration to prevent direct internet access. If exploitation of this vulnerability is suspected, consider changing any potentially compromised sensitive information (such as API keys or credentials) as necessary. Reference information for breach investigations is also available; consult relevant materials as needed.