Fresh MongoDB Vulnerability Exploited in Attacks

Dubbed MongoBleed, the high-severity MongoDB vulnerability (CVE-2025-14847) allows unauthenticated, remote attackers to leak sensitive information from MongoDB servers by abusing the Zlib compression protocol. Patches were released on 19 December 2025, after MongoDB warned that successful exploitation could lead to memory leaks. The flaw can be exploited via crafted compressed messages that cause the server to return the amount of allocated memory rather than the decompressed data length.

On Christmas Eve, Ox Security published a technical analysis of the defect, and two days later Elastic Security’s Joe Desimone released a PoC exploit for it that can extract session tokens, passwords, API keys and other sensitive data.

Ox Security says the vulnerability can be exploited to leak entire databases by sending multiple malformed requests, and according to Wiz, the flawed network message decompression logic is processed before authentication, enabling leakage of fragments of in-memory data without credentials or user interaction. Security researchers observed widespread impact, with Censys noting more than 87,000 vulnerable servers and Kevin Beaumont estimating over 200,000 instances.

According to MongoDB, the fix is in versions 8.2.3, 8.0.17, 7.0.28, 6.0.27, 5.0.32 and 4.4.30, and administrators are advised to update or disable Zlib compression.