MongoBleed: Critical MongoDB Vulnerability Under Active Exploitation
On December 19, 2025, MongoDB Inc. disclosed a severe vulnerability in its database products, tracked as CVE-2025-14847. This flaw, dubbed MongoBleed, is an out-of-bounds memory read vulnerability in MongoDB’s implementation of Zlib message compression. It allows remote, unauthenticated attackers to read limited portions of system memory on MongoDB instances exposed to the internet.
The vulnerability carries a CVSS 4.0 score of 8.7, marking it as critical. A Proof of Concept (PoC) exploit was released on December 25, and by December 29, the issue was added to the CISA Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation in the wild.
Affected Versions
The vulnerability impacts a wide range of MongoDB versions, including:
- MongoDB 8.2.0 – 8.2.2
- MongoDB 8.0.0 – 8.0.16
- MongoDB 7.0.0 – 7.0.26
- MongoDB 6.0.0 – 6.0.26
- MongoDB 5.0.0 – 5.0.31
- MongoDB 4.4.0 – 4.4.29
- All MongoDB Server v4.2, v4.0, and v3.6 versions
Some of these versions date back over a decade, meaning legacy systems are particularly at risk.
Why This Matters
The ease of exploitation combined with the widespread use of MongoDB makes this vulnerability a significant threat. Attackers can potentially extract sensitive data from memory, which could lead to information disclosure or serve as a stepping stone for further attacks.
Mitigation Steps
MongoDB has released patches for affected versions. If patching is not immediately possible, disabling Zlib message compression is an effective workaround.
Action Items for Administrators:
- Identify Exposure: Check if any MongoDB instances are publicly accessible.
- Verify Versions: Confirm if your deployments fall within the affected ranges.
- Apply Patches: Update to the latest secure versions provided by MongoDB.
- Alternative Mitigation: Disable Zlib message compression if patching is delayed.
MongoBleed underscores the importance of timely patching and proactive vulnerability management. Organizations should prioritize securing their MongoDB deployments, especially those exposed to the internet, to prevent exploitation.