MongoBleed: Over 80,000 Servers at Risk of Active Exploitation

Key Findings

• The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added the MongoDB vulnerability CVE-2025-14847, known as "MongoBleed," to its Known Exploited Vulnerabilities (KEV) Catalog.

• The vulnerability, with a CVSS score of 8.7, allows unauthenticated, remote attackers to execute arbitrary code on vulnerable MongoDB servers.

• Over 87,000 potentially vulnerable MongoDB instances have been identified worldwide, primarily located in the U.S., China, Germany, and India.

• A working exploit has been publicly available since December 26, 2025, and initial reports of exploitation in the wild have been reported shortly after.

• CISA has ordered federal agencies to address the vulnerability by January 19, 2026, in accordance with Binding Operational Directive (BOD) 22-01.

Background

MongoDB is a popular open-source NoSQL database used to store and manage data in a flexible, document-based format. The vulnerability CVE-2025-14847, dubbed "MongoBleed," stems from an "Improper Handling of Length Parameter Inconsistency" within the database's use of the zlib compression library.

Technical Details

The vulnerability allows an unauthenticated attacker to transmit a "malformed message asserting an exaggerated decompressed size," leading the server to reserve an expansive memory buffer. The server then inadvertently hemorrhages the contents of this uninitialized memory back to the attacker, enabling the remote harvesting of sensitive data, including secrets, credentials, and other confidential information.

Affected Versions

The vulnerability impacts the following MongoDB versions:

• MongoDB 8.2.0 through 8.2.3

• MongoDB 8.0.0 through 8.0.16

• MongoDB 7.0.0 through 7.0.26

• MongoDB 6.0.0 through 6.0.26

• MongoDB 5.0.0 through 5.0.31

• MongoDB 4.4.0 through 4.4.29

• All versions of 4.2, 4.0, and 3.6

Remediation

MongoDB has released patched versions to address the vulnerability:

• 8.2.3

• 8.0.17

• 7.0.28

• 6.0.27

• 5.0.32

• 4.4.30

Administrators are urged to upgrade to these safe releases immediately. For those unable to patch immediately, the vendor suggests disabling zlib compression on the server and switching to alternative lossless compression options, such as Zstandard (zstd) or Snappy.

CISA Directive

In accordance with Binding Operational Directive (BOD) 22-01, CISA has ordered federal agencies to address the vulnerability by January 19, 2026. Private organizations are also advised to review the KEV Catalog and address the identified vulnerabilities in their infrastructure.

Sources

• https://securityonline.info/cisa-alert-mongobleed-added-to-kev-catalog-as-80000-servers-face-active-exploitation/

• https://securityaffairs.com/186297/hacking/u-s-cisa-adds-a-flaw-in-mongodb-server-to-its-known-exploited-vulnerabilities-catalog.html

• https://x.com/the_yellow_fall/status/2005820880186691737