MongoBleed flaw in MongoDB is exploited in the wild; patches available

Summary

MongoBleed (CVE-2025-14847) lets unauthenticated attackers remotely leak MongoDB server memory. Exploitation has been reported; self-hosted users should patch or disable zlib compression, while Atlas instances were upgraded automatically.

Key points

The flaw affects MongoDB Server’s zlib message-decompression logic before authentication; malformed compressed packets can expose uninitialized heap memory.
Affected releases include specified versions of MongoDB 4.4 through 8.2, as well as all Server versions 3.6, 4.0, and 4.2.
A working exploit was publicly available from December 26, 2025, and exploitation was subsequently reported in the wild. The vulnerability was added to CISA KEV.
MongoDB Atlas instances were upgraded automatically; self-hosted instances remain at risk until patched.
Patched versions are 8.2.3, 8.0.17, 7.0.28, 6.0.27, 5.0.32, and 4.4.30. If patching is not immediately possible, omit zlib compression; the article also recommends restricting network exposure.
Wiz Research published a Nuclei template that sends one crafted packet and checks for BSON signatures to validate exposure without attempting to extract data.

Article Details

Vulnerability Types: Unauthenticated information disclosure through a buffer over-read of uninitialized heap memory
Severity: High
Affected Versions: MongoDB Server 8.2.0 through 8.2.2
MongoDB Server 8.0.0 through 8.0.16
MongoDB Server 7.0.0 through 7.0.27
MongoDB Server 6.0.0 through 6.0.26
MongoDB Server 5.0.0 through 5.0.31
MongoDB Server 4.4.0 through 4.4.29
MongoDB Server 4.2 (all versions)
MongoDB Server 4.0 (all versions)
MongoDB Server 3.6 (all versions)
Exploitation Status: active
Exploit Availability: public_exploit
Patch Status: available
Workarounds: Disable zlib compression by omitting it from networkMessageCompressors or net.compression.compressors; snappy, zstd, or disabling compression entirely are listed as alternatives.