MongoDB Server - Information Disclosure (MongoBleed)

Exploited in the wild. Listed by CISA on 2025-12-29; known to be used by ransomware.

highseverity

7.5CVSS score

83.2%likelihood of exploitation, next 30 days

100%of all CVEs are less likely

Readycheck to confirm it

MongoDB Server contained a flaw in the zlib decompression logic where mismatched length fields in compressed protocol headers allowed a read of uninitialized heap memory by an unauthenticated client.

Impact

Unauthenticated clients can read uninitialized heap memory, potentially exposing credentials, session tokens, API keys, and other sensitive data.

Fix

Update to versions 8.2.3, 8.0.17, 7.0.28, 6.0.27, 5.0.32, or 4.4.30. Alternatively, disable zlib compression using snappy,zstd or disabled.

How to confirm it

Send: tcp probe to {{Hostname}}
Positive when: contains in raw "version" and "gitVersion" AND compare_versions(version, '>= 8.2.0') && compare_versions(version, '<= 8.2.2') or compare_versions(version, '>= 8.0.0') && compare_versions(version, '<= 8.0.16') or compare_versions(version, '>= 7.0.…

Run it with nuclei: nuclei -id CVE-2025-14847 -u <target>

The full check

id: CVE-2025-14847

info:
  name: MongoDB Server - Information Disclosure (MongoBleed)
  author: pussycat0x,joe-desimone,DhiyaneshDK,Wiz Research,diedromeo
  severity: high
  description: |
    MongoDB Server contained a flaw in the zlib decompression logic where mismatched length fields in compressed protocol headers allowed a read of uninitialized heap memory by an unauthenticated client.
  impact: |
    Unauthenticated clients can read uninitialized heap memory, potentially exposing credentials, session tokens, API keys, and other sensitive data.
  remediation: |
    Update to versions 8.2.3, 8.0.17, 7.0.28, 6.0.27, 5.0.32, or 4.4.30. Alternatively, disable zlib compression using snappy,zstd or disabled.
  reference:
    - https://jira.mongodb.org/browse/SERVER-115508
    - https://github.com/joe-desimone/mongobleed
    - https://www.wiz.io/blog/mongobleed-cve-2025-14847-exploited-in-the-wild-mongodb
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2025-14847
    epss-score: 0.83218
    epss-percentile: 0.9968
    cwe-id: CWE-908
  metadata:
    verified: true
    max-request: 1
    vendor: mongodb
    product: mongodb
    shodan-query: product:"MongoDB"
    fofa-query: protocol="mongodb"
  tags: cve,cve2025,mongodb,memory-leak,network,mongobleed,kev,vkev,vuln

tcp:
  - inputs:
      - data: 3b0000003c300000ffffffffd40700000000000061646d696e2e24636d640000000000ffffffff14000000106275696c64696e666f000100000000
        type: hex
    host:
      - "{{Hostname}}"
    port: 27017
    read-size: 2048

    matchers-condition: and
    matchers:
      - type: word
        part: raw
        words:
          - "version"
          - "gitVersion"
        condition: and

      - type: dsl
        dsl:
          - "compare_versions(version, '>= 8.2.0') && compare_versions(version, '<= 8.2.2')"
          - "compare_versions(version, '>= 8.0.0') && compare_versions(version, '<= 8.0.16')"
          - "compare_versions(version, '>= 7.0.0') && compare_versions(version, '<= 7.0.27')"
          - "compare_versions(version, '>= 6.0.0') && compare_versions(version, '<= 6.0.26')"
          - "compare_versions(version, '>= 5.0.0') && compare_versions(version, '<= 5.0.31')"
          - "compare_versions(version, '>= 4.4.0') && compare_versions(version, '<= 4.4.29')"
          - "compare_versions(version, '>= 4.2.0') && compare_versions(version, '<= 4.2.25')"
          - "compare_versions(version, '>= 4.0.0') && compare_versions(version, '<= 4.0.28')"
          - "compare_versions(version, '>= 3.6.0') && compare_versions(version, '<= 3.6.23')"
        condition: or

    extractors:
      - type: regex
        name: version
        part: raw
        group: 1
        regex:
          - '(?s)version.{0,50}?([0-9]+\.[0-9]+\.[0-9]+)'

References

Use this check only on systems you are authorised to test. Where the data comes from