# CVE-2025-14847 Patch for Percona MongoDB release **URL:** \ **Category:** Percona Server for MongoDB\ **Tags:** percona, mongodb, security\ **Created:** [December 26, 2025, 6:20pm UTC](https://forums.percona.com/t/cve-2025-14847-patch-for-percona-mongodb-release/39945 "2025-12-26T18:20:21Z")\ **Posts on this page:** 11\ **Page:** 1
**Author:** ![Samuel\_Vieira](https://sea1.discourse-cdn.com/flex019/user_avatar/forums.percona.com/samuel_vieira/32/21494_2.png) [@Samuel\_Vieira](https://forums.percona.com/u/Samuel_Vieira)\ **Post date:** [December 26, 2025, 6:20pm UTC](https://forums.percona.com/t/cve-2025-14847-patch-for-percona-mongodb-release/39945/1 "2025-12-26T18:20:21Z")
Hello everyone, **CVE-2025-14847** was just dropped out there for MongoDB during Christmas and it can be dangerous. According to Mongo, it was fixed on version 7.0.28https://www.mongodb.com/docs/manual/release-notes/7.0/#7.0.28—dec-19–2025. However, there is no percona release higher than 7.0.26-14. Are you aware of it? Is there anything going on to issue a new release? CVE details can be found here: [https://www.cve.org/CVERecord?id=CVE-2025-14847](https://www.cve.org/CVERecord?id=CVE-2025-14847) This is a PoC of how that can be exploited: [mongobleed/README.md at main · joe-desimone/mongobleed · GitHub](https://github.com/joe-desimone/mongobleed/blob/main/README.md#affected-versions) ---
**Author:** ![Vinodh\_Krishnaswamy](https://sea1.discourse-cdn.com/flex019/user_avatar/forums.percona.com/vinodh_krishnaswamy/32/46_2.png) [@Vinodh\_Krishnaswamy](https://forums.percona.com/u/Vinodh_Krishnaswamy)\ **Post date:** [December 27, 2025, 8:49am UTC](https://forums.percona.com/t/cve-2025-14847-patch-for-percona-mongodb-release/39945/2 "2025-12-27T08:49:23Z")
Hi @Samuel_Vieira , Welcome to the community! Yes, we are aware. Our engineering team is treating this as a top priority and the fix is planned with psmdb v7.0.28-15 & v8.0.17-6 releases. You can expect the release in the near future. Merry Xmas and Happy New Year! Regards, Vinodh Guruji ---
**Author:** ![Samuel\_Vieira](https://sea1.discourse-cdn.com/flex019/user_avatar/forums.percona.com/samuel_vieira/32/21494_2.png) [@Samuel\_Vieira](https://forums.percona.com/u/Samuel_Vieira)\ **Post date:** [December 29, 2025, 7:38am UTC](https://forums.percona.com/t/cve-2025-14847-patch-for-percona-mongodb-release/39945/3 "2025-12-29T07:38:23Z")
Hi @Vinodh_Krishnaswamy , Thank you for letting us know about the progress. Happy New Year! Best regards, Samuel ---
**Author:** ![sujithtee](https://sea1.discourse-cdn.com/flex019/user_avatar/forums.percona.com/sujithtee/32/18989_2.png) [@sujithtee](https://forums.percona.com/u/sujithtee)\ **Post date:** [December 29, 2025, 12:34pm UTC](https://forums.percona.com/t/cve-2025-14847-patch-for-percona-mongodb-release/39945/4 "2025-12-29T12:34:10Z")
Are you guys planning to release for 6.0.X and older versions as well? I see mongodb released 6.0.27 for the vulnerability fix even after the end of life. > **[MongoDB 6.0.27 is released](https://www.mongodb.com/community/forums/t/mongodb-6-0-27-is-released/332826)** > > MongoDB 6.0.27 is out and is ready for production deployment. This release contains only fixes since 6.0.26, and is a recommended upgrade for all 6.0 users. Fixed in this release: SERVER-115508 Make minimally sized buffers for uncompressed... ---
**Author:** ![Jannas](https://avatars.discourse-cdn.com/v4/letter/j/76d3ee/32.png) [@Jannas](https://forums.percona.com/u/Jannas)\ **Post date:** [December 30, 2025, 8:55am UTC](https://forums.percona.com/t/cve-2025-14847-patch-for-percona-mongodb-release/39945/5 "2025-12-30T08:55:30Z")
> [@Vinodh\_Krishnaswamy](#): > > s as a top priority and the fix is planned with psmdb v7.0.28-15 & v8.0.17-6 releases. You can expect the release in the near fu Hi there - any ETA for this release? Or will it only be in the new year? For now we planning to disable the zlib compression as a safety measure until the update is available. ---
**Author:** ![Vinodh\_Krishnaswamy](https://sea1.discourse-cdn.com/flex019/user_avatar/forums.percona.com/vinodh_krishnaswamy/32/46_2.png) [@Vinodh\_Krishnaswamy](https://forums.percona.com/u/Vinodh_Krishnaswamy)\ **Post date:** [December 30, 2025, 10:08am UTC](https://forums.percona.com/t/cve-2025-14847-patch-for-percona-mongodb-release/39945/6 "2025-12-30T10:08:27Z")
Hi @Jannas , Yes, it will be available in January. As you said, disabling the zlib compression until then to avoid any security vulnerability is recommended. i.e explicitly start mongod without zlib compression option. ```auto net: compression: compressors: snappy,zstd ``` with command prompt: ```auto mongos --setParameter networkMessageCompressors=snappy,zstd ``` After that, to confirm `zlib` is disabled, use the command below to verify: ```auto db.adminCommand({ getCmdLineOpts: 1 }).parsed.net.compression ``` Regards, Vinodh Guruji ---
**Author:** ![Jannas](https://avatars.discourse-cdn.com/v4/letter/j/76d3ee/32.png) [@Jannas](https://forums.percona.com/u/Jannas)\ **Post date:** [December 30, 2025, 12:40pm UTC](https://forums.percona.com/t/cve-2025-14847-patch-for-percona-mongodb-release/39945/7 "2025-12-30T12:40:14Z")
Thanks for the update, we will go with that route then. On our side the command : `db.adminCommand({ getCmdLineOpts: 1 }).parsed.net.compression` does not return anything, but we could check it by doing: _**db.serverStatus().network.compression**_ Regards Janneman Nortje ![signature_3279531995](https://sea1.discourse-cdn.com/flex019/images/transparent.png) ---
**Author:** ![radoslaw.szulgo](https://sea1.discourse-cdn.com/flex019/user_avatar/forums.percona.com/radoslaw.szulgo/32/17315_2.png) [@radoslaw.szulgo](https://forums.percona.com/u/radoslaw.szulgo)\ **Post date:** [January 5, 2026, 8:41pm UTC](https://forums.percona.com/t/cve-2025-14847-patch-for-percona-mongodb-release/39945/8 "2026-01-05T20:41:46Z")
Yes, 6.0 patch will be available next week around January, 12, 2026. ---
**Author:** ![Samuel\_Vieira](https://sea1.discourse-cdn.com/flex019/user_avatar/forums.percona.com/samuel_vieira/32/21494_2.png) [@Samuel\_Vieira](https://forums.percona.com/u/Samuel_Vieira)\ **Post date:** [January 7, 2026, 7:39am UTC](https://forums.percona.com/t/cve-2025-14847-patch-for-percona-mongodb-release/39945/9 "2026-01-07T07:39:57Z")
Hello everyone, in case you didn’t see: The 7.0.28-15 release is out there 🙂 [Percona Server for MongoDB 7.0.28-15 (2026-01-06) - Percona Server for MongoDB 7.0](https://docs.percona.com/percona-server-for-mongodb/7.0/release_notes/7.0.28-15.html) ---
**Author:** ![radoslaw.szulgo](https://sea1.discourse-cdn.com/flex019/user_avatar/forums.percona.com/radoslaw.szulgo/32/17315_2.png) [@radoslaw.szulgo](https://forums.percona.com/u/radoslaw.szulgo)\ **Post date:** [January 7, 2026, 9:52am UTC](https://forums.percona.com/t/cve-2025-14847-patch-for-percona-mongodb-release/39945/10 "2026-01-07T09:52:03Z")
Correct. And also a fix for 8.0. See: [https://www.percona.com/blog/urgent-security-update-patching-mongobleed-cve-2025-14847-in-percona-server-for-mongodb/](https://www.percona.com/blog/urgent-security-update-patching-mongobleed-cve-2025-14847-in-percona-server-for-mongodb/) ---
**Author:** ![radoslaw.szulgo](https://sea1.discourse-cdn.com/flex019/user_avatar/forums.percona.com/radoslaw.szulgo/32/17315_2.png) [@radoslaw.szulgo](https://forums.percona.com/u/radoslaw.szulgo)\ **Post date:** [January 12, 2026, 1:29pm UTC](https://forums.percona.com/t/cve-2025-14847-patch-for-percona-mongodb-release/39945/11 "2026-01-12T13:29:54Z")
Fix for 6.0 is released: 6.0.27-21 with a fix for mongobleed was published: [Percona Server for MongoDB 6.0.27-21 (2026-01-12) - Percona Server for MongoDB 6.0](https://docs.percona.com/percona-server-for-mongodb/6.0/release_notes/6.0.27-21.html)