{"id":6341,"date":"2025-12-26T20:19:47","date_gmt":"2025-12-26T20:19:47","guid":{"rendered":"https:\/\/cybersecurityinfocus.com\/?p=6341"},"modified":"2025-12-26T20:19:47","modified_gmt":"2025-12-26T20:19:47","slug":"high-severity-flaw-in-mongodb-could-allow-memory-leakage","status":"publish","type":"post","link":"https:\/\/cybersecurityinfocus.com\/?p=6341","title":{"rendered":"High severity flaw in MongoDB could allow memory leakage"},"content":{"rendered":"
\n
\n
\n
\n
<\/div>\n

Document database vendor MongoDB<\/a> has advised customers to update immediately following the discovery of a flaw that could allow unauthenticated users to read uninitialized heap memory.<\/p>\n

Designated CVE-2025-14847<\/a>, the bug, mismatched length fields in zlib compressed protocol headers, could allow an attacker<\/a> to execute arbitrary code and potentially seize control of a device.<\/p>\n

The flaw affects the following MongoDB and MongoDB Server versions:<\/p>\n

MongoDB 8.2.0 through 8.2.3<\/p>\n

MongoDB 8.0.0 through 8.0.16<\/p>\n

MongoDB 7.0.0 through 7.0.26<\/p>\n

MongoDB 6.0.0 through 6.0.26<\/p>\n

MongoDB 5.0.0 through 5.0.31<\/p>\n

MongoDB 4.4.0 through 4.4.29<\/p>\n

All MongoDB Server v4.2 versions<\/p>\n

All MongoDB Server v4.0 versions<\/p>\n

All MongoDB Server v3.6 versions<\/p>\n

In its advisory<\/a>, MongoDB \u201cstrongly suggested\u201d that users upgrade immediately to the patched versions of the software: MongoDB 8.2.3, 8.0.17, 7.0.28, 6.0.27, 5.0.32, or 4.4.30.<\/p>\n

However, it said, \u201cif you cannot upgrade immediately, disable zlib compression on the MongoDB Server by starting mongod<\/em> or mongos<\/em> with a networkMessageCompressors<\/a> or a net.compression.compressors<\/a> option that explicitly omits zlib.\u201d<\/p>\n

MongoDB, one of the most popular NoSQL document databases<\/a> for developers, says it currently has more than 62,000 customers worldwide, including 70% of the Fortune 100.<\/p>\n

This article originally appeared on InfoWorld<\/a>.<\/em><\/p>\n\n<\/div>\n<\/div>\n<\/div>\n<\/div>","protected":false},"excerpt":{"rendered":"

Document database vendor MongoDB has advised customers to update immediately following the discovery of a flaw that could allow unauthenticated users to read uninitialized heap memory. Designated CVE-2025-14847, the bug, mismatched length fields in zlib compressed protocol headers, could allow an attacker to execute arbitrary code and potentially seize control of a device. The flaw […]<\/p>\n","protected":false},"author":0,"featured_media":6342,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[],"class_list":["post-6341","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-education"],"_links":{"self":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/posts\/6341"}],"collection":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"replies":[{"embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=6341"}],"version-history":[{"count":0,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/posts\/6341\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/media\/6342"}],"wp:attachment":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=6341"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=6341"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=6341"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}