CVE-2025-14847 (MongoBleed) is a critical unauthenticated memory disclosure vulnerability in MongoDB's zlib decompression layer. By sending specially crafted compressed payloads, attackers can cause MongoDB to return uninitialized heap memory before authentication occurs. All MongoDB versions from 4.4 through 8.2 are affected when zlib compression is enabled and the service is network-accessible. Patched versions are available (4.4.30, 5.0.32, 6.0.27, 7.0.28, 8.0.17, 8.2.3). Temporary mitigations include disabling zlib compression and restricting network access. MongoDB 4.2, 4.0, and 3.6 have no fix available.
Table of contents
Key takeawaysHow to see if you are affectedRemediation stepsWho is impactedWhat is Mongobleed?What is the attack about?Initial impactTechnical deep diveScope of attackHow Aikido Security helpsConclusionAppendix: Affected MongoDB VersionsReferencesSort: