ClosedPatched

MongoBleed: pre-auth heap memory leak in MongoDB Server

MongoDB Server

A bug in MongoDB's zlib message decompression let an unauthenticated client read uninitialized heap memory, which can contain credentials, tokens and other data. Public PoCs appeared and CISA confirmed exploitation. Upgrade, or remove zlib from the network compressors and keep MongoDB off the internet.

Why this severity: Pre-auth memory disclosure; public PoC; actively exploited (CISA KEV)

Started: Dec 19, 2025
Closed: Dec 29, 2025
CVE: CVE-2025-14847

Follow this incident

Updated Dec 29, 2025

Affected

MongoDB Server versions before the fixed releases (see vendor advisory)

Fixed in

8.2.3
8.0.17
7.0.28
6.0.27
5.0.32
4.4.30

Timeline3

Dec 29, 2025
Details posted to oss-security
Source
Dec 29, 2025
CISA adds CVE-2025-14847 to KEV (due 2026-01-19)
Dec 19, 2025
MongoBleed disclosed; fixed builds available
Source

Advisories4

News & write-ups2

Notes & caveats

Fixed versions as listed by the Canadian Centre for Cyber Security and the oss-security post; confirm against MongoDB's release notes.

Get an email when a new major security incident drops. No spam, unsubscribe any time.

Get notified