Skip to main content

MongoDB Security Patch (CVE-2025-14847)

The Swagger Studio On-prem 2.13.2 maintenance release addresses a detected MongoDB vulnerability.

It introduces a security patch that modifies MongoDB startup configuration. Following the official MongoDB workaround guidance, mongod is now launched with an additional parameter:

extraFlags:
  - "--networkMessageCompressors=snappy,zstd"

The new parameter disables zlib compression. The safe values you can set it to are: snappy, zstd.

Validate the workaround

To ensure the workaround has been applied, follow these steps:

Open an SSH session into the MongoDB pod.
Run the command:
```
ps aux
```
The list of running processes is returned.
Verify that:
- The mongod startup command contains the networkMessageCompressors parameter.
- The listed compressors do not include zlib.
If the above conditions are met, the workaround has been correctly implemented.

In this section: