Critical 'MongoBleed' Bug Under Active Attack, Patch Now

MongoBleed is a critical memory-leak vulnerability in MongoDB (CVE-2025-14847) that allows unauthenticated remote attackers to extract cleartext credentials, authentication tokens, and other sensitive data from server memory. Attacks began on 29 December 2025, just after publicly available PoC exploit code was published on 26 December 2025, and CISA subsequently confirmed active exploitation in the wild.

Rapid7 tested the PoC and found it fully functional, underscoring the severity of the threat for organisations running self-managed MongoDB instances, according to Rapid7. The vulnerability affects MongoDB servers configured to use the Zlib compression algorithm for network messages, and Rapid7 notes that attackers can exploit it without credentials, though only uninitialized heap memory is leaked.

MongoDB advises upgrading to specific versions (8.2.3, 8.0.17, 7.0.28, 6.0.27, 5.0.32, or 4.4.30) or disabling Zlib compression via mongod/mongos networkMessageCompressors or net.compression.compressors as a temporary safeguard.