Mismatched length fields in Zlib compressed protocol headers may allow a read of uninitialized heap memory by an unauthenticated client. This issue affects all MongoDB Server v7.0 prior to 7.0.28 versions, MongoDB Server v8.0 versions prior to 8.0.17, MongoDB Server v8.2 versions prior to 8.2.3, MongoDB Server v6.0 versions prior to 6.0.27, MongoDB Server v5.0 versions prior to 5.0.32, MongoDB Server v4.4 versions prior to 4.4.30, MongoDB Server v4.2 versions greater than or equal to 4.2.0, MongoDB Server v4.0 versions greater than or equal to 4.0.0, and MongoDB Server v3.6 versions greater than or equal to 3.6.0.
CVSS Details
- CVSS 4.0 Base Score: 8.7 (HIGH)
- CVSS 4.0 Vector: (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X)
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Freebsd | — | Upgrade mongodb70Upgrade mongodb80 | Jan 27, 2026 | Dec 22, 2025 |
| Mongodb | — | Upgrade MongoDB to version 8.0.17Upgrade MongoDB to version 6.0.27Upgrade MongoDB to version 4.4.30Upgrade MongoDB to version 8.2.3Upgrade MongoDB to version 5.0.32Upgrade MongoDB to version 7.0.28 | Dec 27, 2025 | Dec 19, 2025 |
| Splunk | — | Upgrade Splunk Enterprise to version 10.0.3Upgrade Splunk Enterprise to version 9.4.8Upgrade Splunk Enterprise to version 9.3.9Upgrade Splunk Enterprise to version 9.2.12 | Jan 30, 2026 | Dec 19, 2025 |
| Ubuntu | — | Upgrade mongodb (Ubuntu Pro)Upgrade mongodb-server (Ubuntu Pro)Upgrade mongodb-clients (Ubuntu Pro)Upgrade mongodb-server-core (Ubuntu Pro) | Apr 13, 2026 | Dec 19, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub