US, Australia Warn of Exploited MongoDB Flaw

Cybersecurity authorities in the United States and Australia have issued urgent warnings about a critical vulnerability in MongoDB, known as MongoBleed and tracked as CVE-2025-14847, which is under active exploitation by threat actors worldwide. The flaw, which carries a severity score of 8.7 out of 10, affects the popular open-source NoSQL database and enables unauthenticated remote attackers to leak sensitive information from servers exposed on the internet.

The vulnerability arises from improper handling of length parameters in MongoDB's zlib compression protocol during network message decompression. This process occurs before authentication, allowing attackers to send malformed compressed packets that cause the server to return uninitialized heap memory to the client. Over repeated requests, such exploitation can gradually disclose fragments of sensitive in-memory data, including credentials, session keys, API keys, passwords, and internal server states. Researchers from firms like Wiz and Ox Security have detailed how the flaw stems from the server returning the full allocated buffer size rather than the actual decompressed data length, exposing adjacent memory contents.