Dec 29, 2025
0 new incidents, 1 with updates.
Updated
- ClosedPatched
MongoBleed: pre-auth heap memory leak in MongoDB Server
A bug in MongoDB's zlib message decompression let an unauthenticated client read uninitialized heap memory, which can contain credentials, tokens and other data. Public PoCs appeared and CISA confirmed exploitation. Upgrade, or remove zlib from the network compressors and keep MongoDB off the internet.
MongoDB ServerClosed Dec 29, 2025