A not too long ago disclosed security vulnerability in MongoDB has come beneath lively exploitation within the wild, with over 87,000 doubtlessly prone cases recognized internationally.
The vulnerability in query is CVE-2025-14847 (CVSS rating: 8.7), which permits an unauthenticated attacker to remotely leak delicate information from the MongoDB server reminiscence. It has been codenamed MongoBleed.
“A flaw in zlib compression permits attackers to set off data leakage,” OX Safety stated. “By sending malformed community packets, an attacker can extract fragments of personal information.”
The issue is rooted in MongoDB Server’s zlib message decompression implementation (“message_compressor_zlib.cpp”). It impacts cases with zlib compression enabled, which is the default configuration. Profitable exploitation of the shortcoming may permit an attacker to extract delicate data from MongoDB servers, together with person data, passwords, and API keys.
“Though the attacker may must ship a considerable amount of requests to assemble the complete database, and a few information may be meaningless, the extra time an attacker has, the extra data might be gathered,” OX Safety added.
Cloud security firm Wiz stated CVE-2025-14847 stems from a flaw within the zlib-based community message decompression logic, enabling an unauthenticated attacker to ship malformed, compressed community packets to set off the vulnerability and entry uninitialized heap reminiscence with out legitimate credentials or person interplay.
“The affected logic returned the allotted buffer measurement (output.size()) as an alternative of the particular decompressed information size, permitting undersized or malformed payloads to show adjoining heap reminiscence,” security researchers Merav Bar and Amitai Cohen stated. “As a result of the vulnerability is reachable previous to authentication and doesn’t require person interplay, Web-exposed MongoDB servers are notably in danger.”
Data from assault floor administration firm Censys exhibits that there are greater than 87,000 doubtlessly weak cases, with a majority of them positioned within the U.S., China, Germany, India, and France. Wiz famous that 42% of cloud environments have no less than one occasion of MongoDB in a model weak to CVE-2025-14847. This contains each internet-exposed and inner assets.
The precise particulars surrounding the character of assaults exploiting the flaw are presently unknown. Customers are suggested to replace to MongoDB variations 8.2.3, 8.0.17, 7.0.28, 6.0.27, 5.0.32, and 4.4.30. Patches for MongoDB Atlas have been utilized. It is price noting that the vulnerability additionally impacts the Ubuntu rsync bundle, because it makes use of zlib.
As short-term workarounds, it is beneficial to disable zlib compression on the MongoDB Server by beginning mongod or mongos with a networkMessageCompressors or a internet.compression.compressors choice that explicitly omits zlib. Different mitigations embody limiting community publicity of MongoDB servers and monitoring MongoDB logs for anomalous pre-authentication connections.
