MongoBleed (CVE-2025-14847): What MongoDB Users Need to Know About This Memory Leak

MongoBleed, tracked as CVE-2025-14847, is an unauthenticated memory disclosure flaw in MongoDB Server that allows a remote attacker to retrieve fragments of uninitialized heap memory by sending malformed, compressed network messages. The vulnerability arises because MongoDB trusts the uncompressed size declared by the client when handling zlib-compressed requests, potentially leaking memory contents if the size is falsified.

It affects a broad range of releases from 3.6 through early 8.2.x builds, with patched versions available for each major branch, including 8.2.3, 8.0.17, 7.0.28, 6.0.27, 5.0.32, and 4.4.30. The leaked memory can include database credentials, authentication tokens, session identifiers and API keys, or PII processed in memory, and even partial leaks can enable attackers to escalate access or move laterally.

Research from Censys places the figure of publicly accessible MongoDB instances at around 87,000, with some scans suggesting more than 100,000. A public PoC exploit was released in late December 2025 on GitHub by a researcher from Elastic Security, demonstrating how unauthenticated clients can trigger the flaw; according to SOCRadar’s Cyber Threat Intelligence module, this information helps with visibility, prioritisation, and response.

Organisations should patch immediately, disable zlib compression if upgrading is not possible, restrict MongoDB access with firewalls or private networking, monitor logs for pre-authentication patterns, and use the MongoBleed detection tool alongside the official MongoDB security advisory for guidance.