On December 12, 2025, the MongoDB Security Engineering team disclosed a high-severity vulnerability in MongoDB that allows unauthenticated memory disclosure. The issue is tracked as CVE-2025-14847 and has a CVSS score of 8.7 and was quickly nicknamed MongoBleed in the security community due to the way it exposes server memory.
Technical Details
MongoDB uses a custom binary protocol to handle client requests efficiently. To improve network performance, the server supports optional message compression, including the use of the widely adopted zlib library. This compression is negotiated automatically with clients, meaning it is enabled in most standard deployments.
MongoBleed stems from a flaw in how MongoDB processes these compressed messages. Specifically, the server relies on length values supplied in the compressed message headers to determine how much data should be returned to the client. If an attacker supplies a compressed frame that claims a larger decompressed size than the actual data, MongoDB will respond using the allocated buffer size rather than the true length of the decompressed message. This results in portions of uninitialized heap memory being returned to the client.
Because this code path is executed before authentication, an unauthenticated remote client can repeatedly send crafted messages to retrieve additional memory. Over time, repeated exploitation can expose increasingly larger segments of process memory, raising the risk of sensitive information being inadvertently leaked.
The issue impacts the following MongoDB Server versions:
- MongoDB Server v7.0 prior to 7.0.28
- MongoDB Server v8.0 prior to 8.0.17
- MongoDB Server v8.2 prior to 8.2.3
- MongoDB Server v6.0 prior to 6.0.27
- MongoDB Server v5.0 prior to 5.0.32
- MongoDB Server v4.4 prior to 4.4.30
- MongoDB Server v4.2
- MongoDB Server v4.0
- MongoDB Server v3.6
Impact summary
MongoBleed affects standard MongoDB deployments, so most instances are immediately at risk. Exploitation does not require any authentication or special configuration. Simply sending a specially crafted compressed message is sufficient to trigger the memory disclosure.
The exposure of uninitialized memory can undermine data confidentiality and reveal internal runtime state from the server process. Repeated interaction with the vulnerability increases the volume of memory accessible to an attacker over time. Because it is both unauthenticated and straightforward to exploit, organisations should treat this as a high-priority issue.
Mitigating the vulnerability
A fix for MongoBleed is available in the following MongoDB Server versions:
- v7.0.28
- v8.0.17
- v8.2.3
- v6.0.27
- v5.0.32
- v4.4.30
Users running affected versions should upgrade immediately. Instances already on a patched release are no longer vulnerable.
Since the flaw can be triggered without authentication in standard deployments, keeping all MongoDB servers updated is critical to prevent potential memory disclosure. Applying the patch addresses the underlying buffer handling logic in the transport layer and removes the possibility of returning uninitialized memory.
How can Sentrium help?
Sentrium offer vulnerability assessment and penetration testing services that can help you identify vulnerable server deployments across your environments. Start your assessment today by completing our pentest scoping form or get in touch with our team to learn more about how our testing services can support you.
