MongoDB patched CVE-2025-14847 (MongoBleed), a critical vulnerability with CVSS score 8.7 that allows unauthenticated attackers to read sensitive data from heap memory. The flaw stems from improper handling of zlib-compressed network traffic and affects all MongoDB versions since 2017. Security researchers report active exploitation in the wild, with 42% of cloud environments having at least one vulnerable instance and roughly 87,000 potentially exposed servers worldwide. MongoDB Atlas instances are already patched, but self-hosted deployments require immediate updates. The vulnerability can be exploited remotely without authentication, making internet-exposed database servers particularly vulnerable.
Sort: