- CVE-2025-14847 (nicknamed MongoBleed) lets unauthenticated attackers leak memory from MongoDB servers.
- More than 87,000 potentially vulnerable instances were identified worldwide, many with default zlib compression enabled.
- MongoDB has released patches and applied fixes to Atlas; administrators should update to the listed versions or disable zlib compression as a temporary measure.
- Mitigations include restricting network exposure and monitoring logs for abnormal pre-authentication connections.
On Dec 29, 2026, researchers disclosed CVE-2025-14847, a high-severity vulnerability (CVSS 8.7) that lets unauthenticated actors read sensitive data from MongoDB server memory. The flaw, called MongoBleed, affects servers using zlib-based compression and is already being exploited in the wild.
A CVE (Common Vulnerabilities and Exposures) is a standardized identifier for a software security flaw. zlib is a widely used data compression library used to compress and decompress network messages.
OX Security reported that the issue stems from zlib message decompression and noted, “A flaw in zlib compression allows attackers to trigger information leakage,” adding that an attacker can extract data by sending malformed packets (see OX Security). Wiz described how malformed compressed network packets can expose uninitialized heap memory prior to authentication (see Wiz).
Researchers Merav Bar and Amitai Cohen explained the root cause: “The affected logic returned the allocated buffer size (output.length()) instead of the actual decompressed data length, allowing undersized or malformed payloads to expose adjacent heap memory,” as stated in the Wiz analysis.
Data from Censys shows more than 87,000 potentially vulnerable instances, concentrated in the U.S., China, Germany, India, and France. MongoDB advised updating to versions 8.2.3, 8.0.17, 7.0.28, 6.0.27, 5.0.32, and 4.4.30, and has applied patches to Atlas (see Patches for MongoDB Atlas).
The vulnerability also affects the Ubuntu rsync package, which uses zlib. Temporary mitigations include disabling zlib compression by starting mongod or mongos with networkMessageCompressors or net.compression.compressors options that omit zlib, restricting network exposure, and monitoring MongoDB logs for anomalous pre-authentication connections.
✅ Follow BITNEWSBOT on Telegram, Facebook, LinkedIn, X.com, and Google News for instant updates.
Previous Articles:
- US Banks Rush Into Blockchain; 14 Building Bitcoin Tools Now
- Thin Liquidity Raises Odds of Bitcoin January Breakout Soon!
- Ethereum staking entry queue doubles exits, flip rally ahead
- Analyst: Silver Surges 130% in 2025 — Smart Buy for 2026 Now
- Low Liquidations Push Bitcoin Toward $160M Flush, 2026 Peak!
