PoC Released: MongoBleed Exploit Allows Unauthenticated Attackers to Drain MongoDB Memory

PoC Released: MongoBleed exploits have been published by security researcher Joe Desimone, enabling unauthenticated attackers to drain memory in MongoDB via a flaw tracked as CVE-2025-14847. The PoC code carries a CVSS score of 8.7, signalling a high risk to unpatched systems, and the vulnerability allows readers to reveal sensitive in‑memory contents by abusing Zlib compressed protocol headers.

The defect lies in how MongoDB handles decompressed data, where a mismatch between the claimed and actual data size can lead to a read of uninitialised heap memory; MongoDB confirmed in their advisory that no authentication is required for the client‑side exploit.

Affected MongoDB versions span from modern releases back to legacy ones, including 8.2.0–8.2.3, 8.0.0–8.0.16, 7.0.0–7.0.26, 6.0.0–6.0.26, 5.0.0–5.0.31, 4.4.0–4.4.29, and all versions of 4.2, 4.0 and 3.6; fixed versions are 8.2.3, 8.0.17, 7.0.28, 6.0.27, 5.0.32 and 4.4.30. For organisations unable to update immediately, a workaround is to disable Zlib by starting mongod or mongos with net.compression.compressors that omit Zlib, favouring alternatives such as snappy or zstd.

The article notes the availability of PoC code on GitHub and emphasises the rush to patch databases before threat actors can harvest memory contents from vulnerable servers.