Category: Uncategorized

Dec 27, 2025Ravie LakshmananDatabase Security / Vulnerability

A high-severity security flaw has been disclosed in MongoDB that could allow unauthenticated users to read uninitialized heap memory.

The vulnerability, tracked as CVE-2025-14847 (CVSS score: 8.7), has been described as a case of improper handling of length parameter inconsistency, which arises when a program fails to appropriately tackle scenarios where a length field is inconsistent with the actual length of the associated data.

“Mismatched length fields in Zlib compressed protocol headers may allow a read of uninitialized heap memory by an unauthenticated client,” according to a description of the flaw in CVE.org.

The flaw impacts the following versions of the database –

• MongoDB 8.2.0 through 8.2.3
• MongoDB 8.0.0 through 8.0.16
• MongoDB 7.0.0 through 7.0.26
• MongoDB 6.0.0 through 6.0.26
• MongoDB 5.0.0 through 5.0.31
• MongoDB 4.4.0 through 4.4.29
• All MongoDB Server v4.2 versions
• All MongoDB Server v4.0 versions
• All MongoDB Server v3.6 versions

The issue has been addressed in MongoDB versions 8.2.3, 8.0.17, 7.0.28, 6.0.27, 5.0.32, and 4.4.30.

“An client-side exploit of the Server’s zlib implementation can return uninitialized heap memory without authenticating to the server,” MongoDB said. “We strongly recommend upgrading to a fixed version as soon as possible.”

If immediate update is not an option, it’s recommended to disable zlib compression on the MongoDB Server by starting mongod or mongos with a networkMessageCompressors or a net.compression.compressors option that explicitly omits zlib. The other compressor options supported by MongoDB are snappy and zstd.

“CVE-2025-14847 allows a remote, unauthenticated attacker to trigger a condition in which the MongoDB server may return uninitialized memory from its heap,” OP Innovate said. “This could result in the disclosure of sensitive in-memory data, including internal state information, pointers, or other data that may assist an attacker in further exploitation.”

Thailand and Cambodia have agreed to an immediate ceasefire, the defence ministers of both countries have said in a joint statement.

The two sides have agreed to freeze the front lines where they are now, and allow civilians living in border areas to return home, halting almost three weeks of intense clashes in which hundreds of soldiers are believed to have died and nearly one million people displaced.

The ceasefire took effect at noon local time (05:00 GMT) on Saturday. Once it has been in place for 72 hours, 18 Cambodian soldiers held by Thailand since July will be released, the statement said.

The breakthrough came after days of talks between the two countries, with diplomatic encouragement from China and the US.

The agreement prioritises getting the displaced back to their homes, and also includes an agreement to remove landmines.

Thailand’s Defence Minister Natthaphon Narkphanit described the ceasefire as a test for the “other party’s sincerity”.

“Should the ceasefire fail to materialise or be violated, Thailand retains its legitimate right to self-defence under international law,” he told reporters.

Thailand had been reluctant to accept the ceasefire, saying the last one was not properly implemented. They also resented what they saw as Cambodia’s efforts to internationalise the conflict.

Unlike the last ceasefire in July, US President Donald Trump was conspicuously absent from this one, although the US State Department was involved.

That ceasefire agreement collapsed earlier this month, when fresh clashes erupted.

Both sides have blamed each other for the breakdown of the truce.

The Thai army said its troops had responded to Cambodian fire in Thailand’s Si Sa Ket province, in which two Thai soldiers were injured.

Cambodia’s defence ministry said it was Thai forces that had attacked first, in Preah Vihear province, and insisted that Cambodia did not retaliate.

Clashes have continued throughout December. On Friday, Thailand carried out more air strikes inside Cambodia.

The Thai Air Force said it had hit a Cambodian “fortified military position” after civilians had left the area. Cambodia’s defence ministry said the strikes were “indiscriminate attacks” against civilian houses.

How well the ceasefire holds this time depends to a large extent on political will. Nationalist sentiment has been inflamed in both countries.

Cambodia, in particular, has lost many soldiers and a lot of its military equipment. It has been driven back from positions it held on the border, and suffered extensive damage from the Thai air strikes, grievances which could make a lasting peace harder to achieve.

Disagreement over the border dates back more than a century, but tension increased early this year after a group of Cambodian women sang patriotic songs in a disputed temple.

A Cambodian soldier was killed in a clash in May, and two months later, in July, there were five days of intense fighting along the border, which left dozens of soldiers and civilians dead. Thousands more civilians were displaced.

Following intervention by Malaysia and President Trump, a fragile ceasefire was negotiated between the two countries, and signed in late October.

Trump dubbed the agreement the “Kuala Lumpur Peace Accords”. It mandated both sides to withdraw their heavy weapons from the disputed region, and to establish an interim observer team to monitor it.

However, the agreement was suspended by Thailand in November after Thai soldiers were injured by landmines, with Thai Prime Minister Anutin Charnvirakul announcing that the security threat had “not actually decreased”.