# MongoBleed: pre-auth heap memory leak in MongoDB Server · pwn.watch

> A bug in MongoDB's zlib message decompression let an unauthenticated client read uninitialized heap memory, which can contain credentials, tokens and other data. Public PoCs appeared and CISA confirmed exploitation. Upgrade, or remove zlib from the network compressors and keep MongoDB off the internet.

Page: https://pwn.watch/i/mongobleed-mongodb-cve-2025-14847 · generated 2026-10-22T22:41:49.181Z

## Status
- Severity: high · status: closed · patch: patched
- Product: MongoDB Server
- Started: 2025-12-19 · closed: 2025-12-29
- CVEs: CVE-2025-14847
- Affected: MongoDB Server versions before the fixed releases (see vendor advisory)
- Fixed in: 8.2.3; 8.0.17; 7.0.28; 6.0.27; 5.0.32; 4.4.30

## Follow this incident
- RSS (one item per update): https://pwn.watch/i/mongobleed-mongodb-cve-2025-14847/feed.xml
- JSON Feed: https://pwn.watch/i/mongobleed-mongodb-cve-2025-14847/feed.json
- Full data (timeline, sources, posts, agentBrief): https://pwn.watch/i/mongobleed-mongodb-cve-2025-14847.json
- This file: https://pwn.watch/i/mongobleed-mongodb-cve-2025-14847/llms.txt

## Updates (newest first)
- 2025-12-29: Details posted to oss-security (https://www.openwall.com/lists/oss-security/2025/12/29/21)
- 2025-12-29: CISA adds CVE-2025-14847 to KEV (due 2026-01-19)
- 2025-12-19: MongoBleed disclosed; fixed builds available (https://www.cyber.gc.ca/en/alerts-advisories/al25-021-vulnerability-affecting-mongodb-cve-2025-14847)

## Fix brief
# Security brief: MongoBleed: pre-auth heap memory leak in MongoDB Server

Source: https://pwn.watch/i/mongobleed-mongodb-cve-2025-14847 · status: closed (closed Dec 29, 2025) · severity: high · updated Dec 29, 2025

## Patch status
**PATCHED: fixed releases exist. Upgrade to a fixed version.**

## What it is
A bug in MongoDB's zlib message decompression let an unauthenticated client read uninitialized heap memory, which can contain credentials, tokens and other data. Public PoCs appeared and CISA confirmed exploitation. Upgrade, or remove zlib from the network compressors and keep MongoDB off the internet.

Severity detail: Pre-auth memory disclosure; public PoC; actively exploited (CISA KEV)

- Product: MongoDB Server
- CVE / advisory ids: CVE-2025-14847

## Affected versions
- MongoDB Server versions before the fixed releases (see vendor advisory)

## Check whether you're affected
No generic command applies (the product is a hosted service, appliance or desktop app). Check the installed version in its admin UI / About screen and compare with the versions above.

## Fix
Upgrade to one of these fixed versions (or later on the same branch):
- 8.2.3
- 8.0.17
- 7.0.28
- 6.0.27
- 5.0.32
- 4.4.30

After upgrading, re-run the checks above and redeploy/restart the affected services.

## Secrets to rotate
This incident involves possible credential exposure. Rotate any credentials (API keys, tokens, env vars, SSH keys) that were present on affected systems or in affected builds while vulnerable/compromised versions were installed, and review access logs.

## Latest updates
- Dec 29, 2025: Details posted to oss-security
- Dec 29, 2025: CISA adds CVE-2025-14847 to KEV (due 2026-01-19)
- Dec 19, 2025: MongoBleed disclosed; fixed builds available

## Advisories
- [SERVER-115508](https://jira.mongodb.org/browse/SERVER-115508) (MongoDB)
- [AL25-021 - Vulnerability affecting MongoDB - CVE-2025-14847](https://www.cyber.gc.ca/en/alerts-advisories/al25-021-vulnerability-affecting-mongodb-cve-2025-14847) (Canadian Centre for Cyber Security)
- [NVD: CVE-2025-14847](https://nvd.nist.gov/vuln/detail/CVE-2025-14847) (NVD)
- [CISA Known Exploited Vulnerabilities Catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog) (CISA)

## Write-ups & news
- [Threat Brief: MongoDB Vulnerability (CVE-2025-14847)](https://unit42.paloaltonetworks.com/mongobleed-cve-2025-14847/)
- [oss-security: MongoBleed CVE-2025-14847](https://www.openwall.com/lists/oss-security/2025/12/29/21)

## Caveats
Fixed versions as listed by the Canadian Centre for Cyber Security and the oss-security post; confirm against MongoDB's release notes.

---
Machine-readable: https://pwn.watch/i/mongobleed-mongodb-cve-2025-14847.json · all incidents: https://pwn.watch/incidents.json. Verify against the vendor advisory before changing production systems.