MongoDB
MongoDB and MongoDB Server
Affected and fixed version statements observed in the public BlackTree CVE catalogue. These statements describe vulnerability scope, not publisher support entitlement.
This identity is present in BlackTree CVE records, but no product-specific publisher support or retirement history is currently registered in Lifecycle.
A missing support date does not mean the product is supported. CVE publication dates and affected-version ranges must not be interpreted as EOL dates.
CVE-observed version history
| CVE | Published | Affected versions | Fixed version information | Publisher evidence |
|---|---|---|---|---|
| CVE-2025-14847 | 19 Dec 2025 | MongoDB Server: 8.2 < 8.2.3, 8.0 < 8.0.17, 7.0 < 7.0.28, 6.0 < 6.0.27, 5.0 < 5.0.32, 4.4 < 4.4.30, 4.2, 4.0, 3.6 | The Cyber Centre recommends that organizations upgrade affected MongoDB Server(s) to a fixed version: Affected product Affected version Fixed version MongoDB 8.2 8.2.0 – 8.2.2 8.2.3 MongoDB 8.0 8.0.0 – 8.0.16 8.0.17 MongoDB 7.0 7.0.0 – 7.0.27 7.0.28 MongoDB 6.0 6.0.0 – 6.0.26 6.0.27 MongoDB 5.0 5.0.0 – 5.0.31 5.0.32 MongoDB 4.4 4.4.0 – 4.4.29 4.4.30 MongoDB 4.2 All versions No vendor fix; upgrade to fixed version MongoDB 4.0 All versions No vendor fix; upgrade to fixed version MongoDB 3.6 All versions No vendor fix; upgrade to fixed version If immediate patching is not possible, reduce exposure by: Disabling zlib compression by starting mongod/mongos with networkMessageCompressors or net.compression.compressors options that omit zlib (use snappy or zstd). Restricting network access to MongoDB to trusted IPs ; avoid direct internet exposure. As a precaution, it is recommended that organizations review their logs for potential signs of compromise including: Monitor MongoDB logs for anomalous pre-authentication connections or unexpected errors. In addition, the Cyber Centre strongly recommends that organizations review and implement the Cyber Centre’s Top 10 IT Security Actions with an emphasis on the following topics Footnote 6 . Patch operating systems and applications Harden operating systems and applications Isolate web-facing applications Should activity matching the content of this alert be discovered, recipients are encouraged to report via My Cyber Portal , or email contact@cyber.gc.ca . | Update reference ↗ |
How this record is maintained
The CVE inventory is reconciled automatically from cve.blacktree.nl. Exact identity matches link to existing Lifecycle product or package histories. Unmatched products stay in a prioritised publisher-source research queue, and Lifecycle marks the date gap instead of inferring a support boundary from vulnerability data.