MongoDB 3.6.x / 4.0.x / 4.2.x / 4.4.x < 4.4.30 / 5.0.x < 5.0.3...

CVE-2025-14847, branded MongoBleed, is an unauthenticated memory disclosure vulnerability in MongoDB Server's zlib network message compression. A crafted OP_COMPRESSED message claiming a larger uncompressedSize than the actual payload causes MongoDB to allocate an oversized buffer, decompress the small real payload into the start, then return the *entire* buffer — including uninitialized heap contents — back to the client. No authentication, no valid query, no user interaction required. Affected versions span the entire supported tree: 3.6.x, 4.0.x, 4.2.x, 4.4.x < 4.4.30, 5.0.x < 5.0.32, 6.0.x < 6.0.27, 7.0.x < 7.0.28, 8.0.x < 8.0.17, and 8.2.x < 8.2.3. Any MongoDB instance with zlib compression enabled (the default in wire protocol negotiation) is reachable.

MongoDB and Tenable rate this HIGH (CVSS v3 7.5, v4 8.7). That undersells the operational reality. The leaked heap memory routinely contains plaintext credentials, session tokens, SCRAM authentication material, and internal connection strings — artifacts that convert a read-only info-leak into full database compromise and lateral movement. Combined with CISA KEV listing, active in-the-wild exploitation, a trivially weaponized PoC (generated in 10 minutes with an AI coding assistant), 87K–213K internet-exposed instances, and MongoDB's canonical role as a *production data-tier component*, the vendor's HIGH is too low. This is a CRITICAL-class event.

Why this verdict

• Pre-auth, zero-click, network-remote: CVSS vector AV:N/AC:L/PR:N/UI:N means every network-reachable instance is exploitable with no preconditions. No friction gate narrows this.
• Role multiplier: MongoDB is a production database engine by definition. ≥80% of installs serve application data tiers holding credentials, PII, or business-critical data. A heap leak from this role exposes secrets that cascade to full-environment compromise (host → database → lateral → fleet). This floors the verdict at CRITICAL.
• KEV-listed with mass exploitation: CISA KEV entry 2025-12-29, EPSS 83.22% (100th percentile), and confirmed credential-theft campaigns mean this is not theoretical — it is being exploited at scale *right now*.
• Trivial weaponization: Public PoC generated in 10 minutes, multiple GitHub forks, scanner integrations. The skill bar is script-kiddie level.
• Massive exposure surface: 87K–213K internet-facing instances per Shodan/Censys. Even internally-facing MongoDB instances are reachable post-initial-access, and the leaked credentials enable pivot.

Why not higher?

A 9.1 is already near the ceiling. It is not a 10.0 because the *direct* impact is confidentiality-only (information disclosure, not immediate code execution), and heap contents are nondeterministic — an attacker may need multiple requests to recover usable credentials, adding a thin layer of probabilistic friction.

Why not lower?

Downgrading below CRITICAL is not defensible. The affected component *is* the database — it canonically occupies the high-value production data tier. The attack is unauthenticated and remote with zero user interaction. There are no prerequisite compromises. KEV listing and active mass exploitation confirm real-world impact. The CRITICAL floor applies and friction analysis finds no gate that meaningfully narrows the reachable population.

1. Disable zlib compression immediately — Set --networkMessageCompressors snappy,zstd (or none) in mongod.conf and restart. This removes the vulnerable code path entirely without upgrading. Deploy within the 3-day noisgate mitigation SLA for CRITICAL.
2. Block TCP/27017 from untrusted networks — Firewall rules or security groups must restrict MongoDB ports to known application-tier IPs only. No MongoDB instance should ever be internet-facing. Verify with nmap or your attack surface management tool.
3. Enable MongoDB x.509 or mTLS transport authentication — Requiring mutual TLS at the transport layer prevents unauthenticated clients from reaching the compression negotiation phase. This is a defense-in-depth layer if zlib cannot be disabled.
4. Rotate all MongoDB credentials — Assume credentials stored in heap memory have been leaked if any instance was exposed. Rotate SCRAM passwords, connection strings, and any shared secrets. Audit for credential reuse across services.
5. Deploy IDS/IPS signatures for MongoBleed — Vectra, Suricata community rules, and Snort signatures exist for anomalous OP_COMPRESSED size mismatches. Deploy to detect ongoing exploitation attempts while patching proceeds.

Run this on any host with network access to the target MongoDB instance. Requires mongosh (MongoDB Shell) or mongod --version on the target. Example: bash check_mongobleed.sh 10.0.1.50 27017. No special privileges needed for the version check.

#!/usr/bin/env bash
# check_mongobleed.sh — CVE-2025-14847 (MongoBleed) version checker
# Usage: bash check_mongobleed.sh <HOST> [PORT]
# Exit codes: 1=VULNERABLE, 0=PATCHED, 2=UNKNOWN

set -euo pipefail

HOST="${1:?Usage: $0 <HOST> [PORT]}"
PORT="${2:-27017}"

# Fixed versions per branch
declare -A FIXED=(
  [4.4]=4.4.30
  [5.0]=5.0.32
  [6.0]=6.0.27
  [7.0]=7.0.28
  [8.0]=8.0.17
  [8.2]=8.2.3
)

# EOL branches with no fix available
EOL_BRANCHES="3.6 4.0 4.2"

echo "[*] Connecting to ${HOST}:${PORT}..."
VERSION=$(mongosh --host "$HOST" --port "$PORT" --quiet --eval 'db.version()' 2>/dev/null || true)

if [[ -z "$VERSION" ]]; then
  echo "[!] Could not retrieve MongoDB version from ${HOST}:${PORT}"
  echo "UNKNOWN"
  exit 2
fi

echo "[*] Detected MongoDB version: ${VERSION}"

MAJOR_MINOR=$(echo "$VERSION" | grep -oP '^[0-9]+\.[0-9]+')

# Check EOL branches
for eol in $EOL_BRANCHES; do
  if [[ "$MAJOR_MINOR" == "$eol" ]]; then
    echo "[!] MongoDB ${VERSION} is EOL branch ${eol} — no patch available."
    echo "VULNERABLE"
    exit 1
  fi
done

# Check supported branches
if [[ -n "${FIXED[$MAJOR_MINOR]+x}" ]]; then
  FIXED_VER="${FIXED[$MAJOR_MINOR]}"
  # Compare versions using sort -V
  LOWEST=$(printf '%s\n%s' "$VERSION" "$FIXED_VER" | sort -V | head -n1)
  if [[ "$LOWEST" == "$FIXED_VER" ]] || [[ "$VERSION" == "$FIXED_VER" ]]; then
    echo "[+] MongoDB ${VERSION} >= ${FIXED_VER} — patched."
    echo "PATCHED"
    exit 0
  else
    echo "[!] MongoDB ${VERSION} < ${FIXED_VER} — vulnerable to CVE-2025-14847."
    echo "VULNERABLE"
    exit 1
  fi
else
  echo "[?] MongoDB ${VERSION} (branch ${MAJOR_MINOR}) not in known affected range."
  echo "UNKNOWN"
  exit 2
fi

Sources

1. Tenable Plugin 280124
2. BleepingComputer — MongoBleed 87K servers exposed
3. Akamai — CVE-2025-14847 Deep Dive
4. Unit 42 — MongoBleed Threat Brief
5. joe-desimone/mongobleed PoC (GitHub)
6. Censys Advisory — CVE-2025-14847
7. Vectra AI — MongoBleed in the Wild
8. Eric Capuano — Hunting MongoBleed