https://pwn.watch/t/mongodb Live security incidents worldwide: CVEs, patch status, fixed versions, advisories and the posts that broke them. en Mon, 29 Dec 2025 00:00:00 GMT https://pwn.watch/i/mongobleed-mongodb-cve-2025-14847 https://pwn.watch/i/mongobleed-mongodb-cve-2025-14847 Mon, 29 Dec 2025 00:00:00 GMT high <p>A bug in MongoDB's zlib message decompression let an unauthenticated client read uninitialized heap memory, which can contain credentials, tokens and other data. Public PoCs appeared and CISA confirmed exploitation. Upgrade, or remove zlib from the network compressors and keep MongoDB off the internet.</p> <p><strong>Status:</strong> closed · <strong>Patch:</strong> patched · <strong>Fixed in:</strong> 8.2.3, 8.0.17, 7.0.28, 6.0.27, 5.0.32, 4.4.30</p> <p><strong>Latest updates:</strong></p><ul><li>2025-12-29: Details posted to oss-security (<a href="https://www.openwall.com/lists/oss-security/2025/12/29/21">source</a>)</li><li>2025-12-29: CISA adds CVE-2025-14847 to KEV (due 2026-01-19)</li><li>2025-12-19: MongoBleed disclosed; fixed builds available (<a href="https://www.cyber.gc.ca/en/alerts-advisories/al25-021-vulnerability-affecting-mongodb-cve-2025-14847">source</a>)</li></ul> <p><strong>CVEs:</strong> CVE-2025-14847</p>