---
title: "MongoBleed: Pre-Auth Memory Leak in MongoDB Server"
url: https://erroneo.us/security/briefs/mongobleed-mongodb-zlib-memory-leak/
description: "CVE-2025-14847 leaks heap memory from self-hosted MongoDB via zlib, no login needed. Exploited, in KEV. Fixed in 8.2.3/8.0.17/7.0.28 and earlier lines."
type: security-brief
section: "Security Digest"
date_published: 2025-12-19
date_modified: 2026-10-21
publisher: erroneo.us
author: erroneo.us Security Desk
verdict: "Patch this week"
cves: ["CVE-2025-14847"]
severity: "high"
exploited: "in-the-wild"
kev: true
license: All rights reserved. Quote with attribution and a link.
---

# MongoBleed: Pre-Auth Memory Leak in MongoDB Server

**Verdict: Patch this week.** Atlas users are already patched; self-hosted MongoDB that untrusted networks can reach must be upgraded (or have zlib disabled) now, and internet-exposed instances should rotate credentials.

- **Who must act:** Anyone running self-managed MongoDB 3.6 through 8.2.2, especially instances reachable from the internet or from shared or untrusted networks.
- **Who can relax:** MongoDB Atlas customers (patched by MongoDB before disclosure) and self-hosted servers already on 8.2.3, 8.0.17, 7.0.28, 6.0.27, 5.0.32 or 4.4.30.
- **Affected:** MongoDB Server 8.2 before 8.2.3; 8.0 before 8.0.17; 7.0 before 7.0.28; 6.0 before 6.0.27; 5.0 before 5.0.32; 4.4 before 4.4.30; 4.2, 4.0 and 3.6 (all versions, end of life, no fix)
- **Fixed:** MongoDB Server 8.2.3; 8.0.17; 7.0.28; 6.0.27; 5.0.32; 4.4.30
- **CVEs:** CVE-2025-14847
- **CISA KEV:** yes · **Exploitation:** Exploited in the wild

## What to do

1. Check every self-managed node's version: mongod --version or db.version() in mongosh
2. Upgrade to the fixed release in your branch; move 3.6/4.0/4.2 deployments to a supported, patched branch
3. If you cannot upgrade immediately, remove zlib: start mongod/mongos with --networkMessageCompressors snappy,zstd (or set net.compression.compressors: snappy,zstd)
4. Take MongoDB off the public internet and restrict port 27017 to application hosts
5. If an instance was internet-exposed while vulnerable, rotate database users' passwords and any secrets the data or application held

### How to check if you are affected

- List exposed instances: any mongod bound to 0.0.0.0 with port 27017 reachable from outside your VPC
- Look for connection spikes (several times normal) and very high counts of short-lived connections from a single source
- Look for connections that never send client metadata after connecting, a pattern associated with the public PoC
- Review auth and audit logs for logins using credentials that could have leaked from memory

## What happened

On December 19, 2025, MongoDB published **CVE-2025-14847**, quickly nicknamed MongoBleed. The [CVE record](https://www.cve.org/CVERecord?id=CVE-2025-14847) says "mismatched length fields in Zlib compressed protocol headers may allow a read of uninitialized heap memory by an unauthenticated client." [Kudelski Security explains](https://kudelskisecurity.com/research/cve-2025-14847-is-a-high-severity-memory-disclosure-vulnerability-in-mongodb-servers-handling-of-zlib-compressed-network-protocol-headers) that the server trusted a length supplied on the wire. A crafted compressed message makes the declared and actual decompressed sizes disagree, and the server sends back leftover heap memory. That memory can contain other clients' queries, credentials and keys.

MongoDB says its own Security Engineering team [found the issue on December 12](https://www.mongodb.com/company/blog/news/mongodb-server-security-update-december-2025) and patched most of the Atlas fleet by December 17. It finished Atlas on December 18 and published the CVE the next day. The fix is tracked as SERVER-115508. MongoDB scores it CVSS 4.0 8.7 (v3.1: 7.5). It is a memory disclosure bug, not remote code execution.

## Who is affected

Self-managed MongoDB Server on these branches: 8.2 before 8.2.3, 8.0 before 8.0.17, 7.0 before 7.0.28, 6.0 before 6.0.27, 5.0 before 5.0.32 and 4.4 before 4.4.30. All 4.2, 4.0 and 3.6 releases are also vulnerable, and because those branches are end of life they get no fix. That covers Community and Enterprise Advanced builds, the official Docker images, and distro packages that track them. MongoDB says Atlas clusters were patched for customers before disclosure.

## Do you really need to act?

It depends on reachability, but the bar for "reachable" is low. The attack needs no credentials, only a TCP connection to a server that accepts zlib compression. Kudelski describes zlib as enabled by default. [Security Affairs reports](https://securityaffairs.com/186297/hacking/u-s-cisa-adds-a-flaw-in-mongodb-server-to-its-known-exploited-vulnerabilities-catalog.html) that Censys counted more than 87,000 potentially vulnerable internet-facing instances, and that a public exploit by Joe Desimone has circulated since December 26, 2025. CISA added the CVE to the KEV catalog on December 29, 2025, with a federal deadline of January 19, 2026. The KEV entry confirms active exploitation, though public detail on specific attacks remained thin as of this writing.

If your database sits on a private subnet that only your application servers can reach, an attacker would first need a foothold inside that network. Patch on your normal urgent cadence. If it was ever reachable from the internet while vulnerable, assume memory contents may have leaked, and rotate secrets as well as patching. Each probe returns a small, random slice of memory, but the PoC automates thousands of them.

## What to do now

1. Check versions on every node with `mongod --version`, or `db.version()` in mongosh.
2. Upgrade to 8.2.3, 8.0.17, 7.0.28, 6.0.27, 5.0.32 or 4.4.30 (or later). Plan a branch upgrade for anything on 4.2 or older.
3. As a stopgap, disable zlib with `--networkMessageCompressors snappy,zstd`, or in config: `net.compression.compressors: snappy,zstd`. Kudelski notes you can also disable compression entirely.
4. Close port 27017 to the internet and enforce authentication and TLS. That will not stop this pre-auth bug, but it shrinks who can reach it.
5. For instances that were exposed, rotate database user passwords, application secrets and any cloud credentials stored in or passing through MongoDB.

## How to tell if you were hit

Exploitation leaves few traces, because the attacker reads memory rather than data files. Kudelski suggests watching for connection volume several times above normal, since PoC runs open tens of thousands of short connections. It also flags connections that never send the client metadata a real driver sends. Review MongoDB logs from mid-December onward for bursts of connections from unfamiliar IPs, then check authentication logs for later logins with credentials that could have leaked. With no logs, treat an exposed, unpatched instance as compromised and rotate credentials.

## Timeline

- Dec 12, 2025 — MongoDB Security Engineering detects the issue.
- Dec 18, 2025 — Atlas fleet fully patched.
- Dec 19, 2025 — CVE-2025-14847 published.
- Dec 23, 2025 — MongoDB posts patch and upgrade instructions on its community forum.
- Dec 26, 2025 — Public proof-of-concept circulates.
- Dec 29, 2025 — CISA adds the CVE to KEV. MongoDB publishes its blog timeline.

## Sources

1. [MongoDB — MongoDB Server Security Update, December 2025](https://www.mongodb.com/company/blog/news/mongodb-server-security-update-december-2025)
2. [CVE.org — CVE-2025-14847 record (incl. CISA KEV entry)](https://www.cve.org/CVERecord?id=CVE-2025-14847)
3. [Kudelski Security — Mongobleed CVE-2025-14847 advisory](https://kudelskisecurity.com/research/cve-2025-14847-is-a-high-severity-memory-disclosure-vulnerability-in-mongodb-servers-handling-of-zlib-compressed-network-protocol-headers)
4. [Security Affairs — CISA adds a flaw in MongoDB Server to KEV](https://securityaffairs.com/186297/hacking/u-s-cisa-adds-a-flaw-in-mongodb-server-to-its-known-exploited-vulnerabilities-catalog.html)

---
Source page: https://erroneo.us/security/briefs/mongobleed-mongodb-zlib-memory-leak/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt