CVE-2025-14847

MongoDB can accept compressed “network messages” from clients. This bug gets confused about a length value inside those compressed messages, which can cause the server to accidentally expose pieces of its own memory. Think of it like a mailroom that sometimes reads the wrong number of pages from a letter folder and accidentally shows a bit of what was inside the folder instead of the letter.

This matters if you run mongodb (including deployments on Red OS or Mailion variants that include mongodb) and it listens for network connections from other machines. The flaw does not require a login or user interaction, so an attacker just needs network access to reach the service. Because it’s reachable over the network and requires no authentication, prioritize exposure to the internet or any untrusted network paths (only safe if the service is not reachable from outside).

This is RED because CISA has it in its Known Exploited Vulnerabilities list, which means it’s treated as actively relevant and should be remediated on a strict timeline. The vulnerability allows an unauthenticated remote client to read memory, so attackers don’t need stolen credentials to start testing.