MongoDB Vulnerability CVE-2025-14847 Under Active Exploitation Worldwide

"The problem is rooted in MongoDB Server's zlib message decompression implementation ("message_compressor_zlib.cpp"). It affects instances with zlib compression enabled, which is the default configuration. Successful exploitation of the shortcoming could allow an attacker to extract sensitive information from MongoDB servers, including user information, passwords, and API keys."

""A flaw in zlib compression allows attackers to trigger information leakage," OX Security said. "By sending malformed network packets, an attacker can extract fragments of private data.""

"Cloud security company Wiz said CVE-2025-14847 stems from a flaw in the zlib-based network message decompression logic, enabling an unauthenticated attacker to send malformed, compressed network packets to trigger the vulnerability and access uninitialized heap memory without valid credentials or user interaction. "The affected logic returned the allocated buffer size (output.length()) instead of the actual decompressed data length, allowing undersized or malformed payloads to expose adjacent heap memory," security researchers Merav Bar and Amitai Cohen said. "Because the vulnerability is reachable prior to authentication and does not require user interaction, Internet-exposed MongoDB servers are particularly at risk.""

An unauthenticated remote information-leak vulnerability (CVE-2025-14847, MongoBleed, CVSS 8.7) affects MongoDB servers with zlib compression enabled by default. The flaw resides in the zlib message decompression implementation and allows attackers to send malformed compressed network packets to access uninitialized heap memory and remotely leak sensitive data such as user records, passwords, and API keys. Exploitation does not require authentication or user interaction and is actively observed in the wild, with over 87,000 potentially vulnerable instances identified. The underlying bug causes the code to return the allocated buffer size instead of the actual decompressed length, exposing adjacent heap memory.

Read at The Hacker News