MongoBleed flaw leaks MongoDB server memory, exploitation under way

The Canadian Centre for Cyber Security warned on Dec. 29 that attackers are exploiting a MongoDB Server vulnerability that leaks uninitialized memory to unauthenticated users, and urged organizations to upgrade. CISA added the flaw to its Known Exploited Vulnerabilities catalog the same day.

The bug, CVE-2025-14847, has been nicknamed MongoBleed in reference to the 2014 Heartbleed flaw in OpenSSL, because it works the same basic way: the server can be tricked into returning memory it should not, which may contain credentials or other sensitive data. It is reachable before authentication on any server that accepts network connections with zlib compression enabled.

What happened

MongoDB published fixes on Dec. 19, and the Cyber Centre issued advisory AV25-862 on Dec. 24. According to Wiz, a working proof-of-concept exploit written by Joe Desimone of Elastic Security became public on Dec. 26, and exploitation in the wild was reported shortly after. Censys counted about 87,000 potentially vulnerable instances exposed online, and Wiz said 42 per cent of the cloud environments it monitors had at least one vulnerable MongoDB instance, including internal ones. MongoDB Atlas, the vendor's managed service, was patched automatically.

The flaw stems from mismatched length fields in zlib-compressed protocol headers. MongoDB rates it 8.7 under CVSS 4.0.

Fixed versions

• MongoDB 8.2.3, 8.0.17, 7.0.28, 6.0.27, 5.0.32 and 4.4.30
• Versions 4.2, 4.0 and 3.6 are affected and will not be fixed. They must be upgraded to a supported branch.

What to do

• Upgrade self-managed MongoDB servers to a fixed version.
• If you cannot patch right away, the Cyber Centre advises disabling zlib compression by setting the network compressors option to snappy or zstd, or turning compression off.
• Do not expose MongoDB directly to the internet. Limit access to trusted IP addresses.
• Review logs for unusual pre-authentication connections or crashes, and rotate database and application credentials on servers that were exposed before patching.
• Report suspicious activity through My Cyber Portal or [email protected].