MongoDB Improper Handling of Length Parameter Inconsistency (CVE-2025-14847)
Detects exploitation attempts targeting CVE-2025-14847, an improper handling of length parameter inconsistency vulnerability (CWE-130) in MongoDB and MongoDB Server. This vulnerability is listed in CISA's Known Exploited Vulnerabilities catalog, indicating active exploitation in the wild. Attackers may craft malformed requests with inconsistent length parameters to cause unexpected server behavior, potentially leading to denial of service, data corruption, or unauthorized access.
Vulnerability Intelligence
KEV — Known ExploitedAffected Software
- Vendor
- MongoDB
- Product
- MongoDB and MongoDB Server
Weakness (CWE)
Timeline
- Disclosed
- December 29, 2025
References & Proof of Concept
CVSS
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
What is CVE-2025-14847 MongoDB Improper Handling of Length Parameter Inconsistency (CVE-2025-14847)?
MongoDB Improper Handling of Length Parameter Inconsistency (CVE-2025-14847) (CVE-2025-14847) maps to the Initial Access and Impact tactics — the adversary is trying to get into your network in MITRE ATT&CK.
This page provides production-ready detection logic for MongoDB Improper Handling of Length Parameter Inconsistency (CVE-2025-14847), covering the data sources and telemetry it touches: MongoDB Diagnostic Logs, Syslog, CommonSecurityLog, Azure Monitor. The queries below are rated high severity at medium confidence, and ship for 7 SIEM platforms — KQL, SPL, Elastic, QRadar, Sumo, YARA-L, LogScale.
MITRE ATT&CK
- Tactic
- Initial Access Impact
union isfuzzy=true
(
MongoDBDiagnosticLogs
| where TimeGenerated >= ago(24h)
| where Message has_any ("length", "BSONObj", "invalid", "assertion", "exception", "malformed")
| where Message matches regex @"(?i)(length.*inconsisten|param.*mismatch|bson.*invalid|buffer.*overflow|assertion.*failed)"
| project TimeGenerated, Computer, Message, Severity
),
(
Syslog
| where TimeGenerated >= ago(24h)
| where ProcessName has_any ("mongod", "mongos")
| where SyslogMessage has_any ("length", "assertion", "exception", "invalid", "malformed")
| where SyslogMessage matches regex @"(?i)(length.*inconsisten|param.*mismatch|bson.*invalid|assertion.*failed)"
| project TimeGenerated, Computer, ProcessName, SyslogMessage
),
(
CommonSecurityLog
| where TimeGenerated >= ago(24h)
| where DestinationPort in (27017, 27018, 27019)
| where Message has_any ("length", "malformed", "invalid", "error")
| project TimeGenerated, DeviceVendor, SourceIP, DestinationIP, DestinationPort, Message
)
| sort by TimeGenerated descDetects MongoDB log entries and network traffic indicative of CVE-2025-14847 exploitation via length parameter inconsistency. Targets MongoDB diagnostic logs, syslog from mongod/mongos processes, and network flows to MongoDB ports.
Data Sources
Required Tables
False Positives
- Legitimate MongoDB administrative operations that trigger assertion messages during maintenance windows
- Automated backup or migration tools that interact with MongoDB on standard ports and produce verbose logging
- MongoDB version upgrades or configuration changes that temporarily generate error messages resembling exploitation patterns
- Load testing or performance benchmarking tools sending high volumes of requests to MongoDB ports
Sigma rule & cross-platform mapping
The detection logic for MongoDB Improper Handling of Length Parameter Inconsistency (CVE-2025-14847) (CVE-2025-14847) above is provided in a vendor-neutral
form so you can deploy it on any SIEM. The same logic is shipped here as native
KQL (Microsoft Sentinel / Defender), SPL (Splunk), Elastic (Elastic Security (EQL)), QRadar (IBM QRadar (AQL)), Sumo (Sumo Logic CSE), YARA-L (Google Chronicle / SecOps), LogScale (CrowdStrike LogScale (CQL)) queries. In Sigma terms, this detection targets the
following logsource:
logsource:
product: azureBrowse the community-maintained Sigma rules for this technique:
Platform-specific guides for CVE-2025-14847
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Send Malformed BSON Message with Inconsistent Length to MongoDB
Expected signal: MongoDB diagnostic log should record a parse error, assertion failure, or connection reset. Network capture should show malformed wire protocol frame followed by TCP RST or server-side close.
- Test 2Fuzzing MongoDB Port with Length Boundary Payloads
Expected signal: Multiple connection events on port 27017 in rapid succession, followed by MongoDB log entries for parser errors or assertion failures for each boundary value tested.
- Test 3Verify MongoDB Version and Patch Status
Expected signal: MongoDB audit log (if enabled) records a connection and command execution from localhost. Authentication log shows anonymous or credential-less connection attempt.
Response Playbook
Triage
- Identify all MongoDB instances in the environment and cross-reference against affected version list; prioritize internet-exposed or externally reachable MongoDB nodes.
- Review MongoDB diagnostic logs (default: /var/log/mongodb/mongod.log) for assertion failures, BSON parsing errors, or length inconsistency messages occurring around the alert timestamp.
- Check MongoDB server version using 'db.version()' or 'mongod --version' on affected hosts; determine if a patched version is available and has been applied.
- Correlate source IPs of suspicious connections to MongoDB ports (27017-27019) against threat intelligence feeds and internal asset inventory to distinguish internal from external actors.
- Review MongoDB access logs and authentication events for unusual client connections, especially unauthenticated access or connections from unexpected IP ranges.
Containment
- Immediately restrict network access to MongoDB ports (27017, 27018, 27019) using firewall rules or security groups, allowing only known application servers and DBA hosts.
- If active exploitation is confirmed, isolate the affected MongoDB host from the network and initiate snapshot/backup of the data directory before any remediation to preserve forensic evidence.
- Rotate all MongoDB credentials and connection string secrets; revoke and regenerate API keys or Vault leases associated with MongoDB access.
Evidence Collection
- Collect MongoDB diagnostic logs (/var/log/mongodb/mongod.log), system logs (/var/log/syslog or /var/log/messages), and network capture (pcap) of traffic on MongoDB ports during the attack window.
- Export MongoDB oplog entries from the affected timeframe using 'db.oplog.rs.find({ts: {$gte: Timestamp(<start>), $lte: Timestamp(<end>)}})' to identify unauthorized write or read operations.
- Capture process listing, open file handles, and network connections from the MongoDB host at time of detection using 'ps aux', 'lsof -i :27017', and 'ss -tulnp'.
Escalation Criteria
- ! Escalate immediately if evidence of data exfiltration is found, such as large outbound transfers from the MongoDB host to external IPs or unexpected dump files in the filesystem.
- ! Escalate if the MongoDB instance contains PII, PHI, financial records, or other sensitive data and any unauthorized access or modification is confirmed, triggering breach notification obligations.
Investigation Guide
Forensic Artifacts
- >
MongoDB diagnostic log entries containing assertion failures, BSON parsing errors, or length parameter warnings at /var/log/mongodb/mongod.log - >
Network PCAP showing malformed MongoDB wire protocol messages with inconsistent length fields targeting port 27017/27018/27019 - >
MongoDB profiler output (db.system.profile) capturing slow or failed queries from attacker IP addresses during the exploitation window - >
OS-level audit logs (auditd) recording unexpected mongod process crashes or restarts coinciding with attack activity
Tuning Guidance
Reduce false positives by baselining normal MongoDB assertion and error rates per host over a 30-day period and alerting only on statistically significant deviations. Exclude known maintenance windows and scheduled backup job timeframes. Scope the detection to production MongoDB instances only, excluding dev/QA environments. If MongoDB audit logging is enabled, enrich alerts with authenticated username to distinguish legitimate DBA activity from anonymous or unexpected client connections. Consider raising confidence to 'high' once a specific patched version boundary is confirmed in the MongoDB advisory.
Hunting Queries
Retrospective 7-day hunt across MongoDB log sources for repeated assertion and BSON error patterns that may indicate CVE-2025-14847 probing or exploitation attempts preceding the initial alert.
Syslog
| where TimeGenerated >= ago(7d)
| where ProcessName has_any ("mongod", "mongos")
| where SyslogMessage has_any ("assertion", "exception", "BSON", "length", "malformed")
| summarize event_count=count(), first_seen=min(TimeGenerated), last_seen=max(TimeGenerated) by Computer, ProcessName, SyslogMessage
| where event_count > 5
| order by event_count descindex=* sourcetype IN ("mongod", "mongodb", "syslog") earliest=-7d
| regex _raw="(?i)(assertion|exception|bson|length|malformed)"
| stats count as hits, earliest(_time) as first_seen, latest(_time) as last_seen by host, sourcetype
| where hits > 5
| sort - hitsAtomic Red Team Tests
Simulates CVE-2025-14847 by crafting a raw MongoDB wire protocol message with a declared length field that does not match the actual payload length, targeting the vulnerability in the BSON parser.
Command
python3 -c "
import socket, struct
# Craft a MongoDB OP_MSG with inconsistent messageLength header
payload = b'\x00' * 20 # intentionally short body
msg_length = 9999 # declared length far exceeds actual payload
request_id = 1
response_to = 0
op_code = 2013 # OP_MSG
header = struct.pack('<iiii', msg_length, request_id, response_to, op_code)
malformed = header + payload
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.connect(('127.0.0.1', 27017))
s.send(malformed)
try:
resp = s.recv(4096)
print('Response received:', resp[:50])
except Exception as e:
print('Exception (expected):', e)
finally:
s.close()
"Cleanup
No persistent changes; connection is closed after test. Verify mongod process is still running with 'systemctl status mongod' or 'ps aux | grep mongod'.Expected Telemetry
MongoDB diagnostic log should record a parse error, assertion failure, or connection reset. Network capture should show malformed wire protocol frame followed by TCP RST or server-side close.
Expected Detection
Triggers on MongoDB log assertion/BSON error patterns; network-based detections should fire on malformed OP_MSG to port 27017.
Uses a simple fuzzing loop to send multiple BSON messages with varying declared lengths versus actual body sizes to probe MongoDB's length parameter handling across boundary conditions.
Command
python3 -c "
import socket, struct, time
target = ('127.0.0.1', 27017)
for declared_len in [0, 1, 4, 16, 256, 65535, 2147483647]:
try:
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.settimeout(2)
s.connect(target)
body = b'\xde\xad\xbe\xef' * 4
header = struct.pack('<iiii', declared_len, 2, 0, 2013)
s.send(header + body)
resp = s.recv(1024)
print(f'len={declared_len}: got {len(resp)} bytes back')
except Exception as e:
print(f'len={declared_len}: {type(e).__name__}: {e}')
finally:
s.close()
time.sleep(0.1)
"Cleanup
No persistent changes; all sockets are closed. Run 'systemctl status mongod' to confirm service health post-test.Expected Telemetry
Multiple connection events on port 27017 in rapid succession, followed by MongoDB log entries for parser errors or assertion failures for each boundary value tested.
Expected Detection
High-frequency connection bursts to MongoDB port combined with repeated error log entries should trigger rate-based and pattern-based detection rules.
Enumerates the MongoDB version running on the target host to determine whether the instance is running a vulnerable version, simulating reconnaissance an attacker would perform before exploiting CVE-2025-14847.
Command
mongosh --host 127.0.0.1 --port 27017 --eval 'db.version(); db.adminCommand({buildInfo:1}).version; db.adminCommand({buildInfo:1}).gitVersion' --quiet 2>/dev/null || mongo --host 127.0.0.1 --port 27017 --eval 'db.version()' --quiet 2>/dev/null || python3 -c "
import socket, struct, json
s = socket.socket()
s.connect(('127.0.0.1', 27017))
# OP_QUERY on admin.$cmd for isMaster to fingerprint version
query = b'\x00' * 4 + b'{\"isMaster\": 1}'
header = struct.pack('<iiii', len(query)+16, 1, 0, 2004)
s.send(header + b'\x00' * 4 + b'admin.\$cmd\x00' + struct.pack('<ii', 0, 1) + query)
print('Version probe sent; check MongoDB logs for connection')
s.close()
"Cleanup
No changes made to the MongoDB instance. Connection is closed after version enumeration.Expected Telemetry
MongoDB audit log (if enabled) records a connection and command execution from localhost. Authentication log shows anonymous or credential-less connection attempt.
Expected Detection
Unauthenticated buildInfo or isMaster command from a non-application source IP may trigger anomalous access detection; confirms vulnerability recon phase.