PT-2025-52440 · Mongodb+3 · Mongodb Server+4
CVSS v3.1
9.8
Critical
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
MongoDB Server versions prior to 8.2.3
MongoDB Server versions prior to 8.0.17
MongoDB Server versions prior to 7.0.28
MongoDB Server versions prior to 6.0.27
MongoDB Server versions prior to 5.0.32
MongoDB Server versions prior to 4.4.30
MongoDB Server versions 3.6.0 through 4.2.x
Description
An issue in the decompression logic of zlib-compressed network messages allows an unauthenticated remote attacker to read uninitialized heap memory. By sending specially crafted malformed packets with mismatched length fields, an attacker can cause the server to allocate an oversized memory buffer and return fragments of its own heap memory to the client. This memory may contain sensitive information such as passwords, API keys, session tokens, and other secrets. Approximately 87,000 MongoDB servers are estimated to be exposed to the internet and potentially vulnerable, with 42% of cloud environments containing at least one vulnerable instance. Real-world exploitation has been reported, including claims of a breach at Ubisoft where the flaw was allegedly used to pivot into internal repositories and steal source code and user data.
Recommendations
Upgrade MongoDB Server to version 8.2.3 or newer.
Upgrade MongoDB Server to version 8.0.17 or newer.
Upgrade MongoDB Server to version 7.0.28 or newer.
Upgrade MongoDB Server to version 6.0.27 or newer.
Upgrade MongoDB Server to version 5.0.32 or newer.
Upgrade MongoDB Server to version 4.4.30 or newer.
As a temporary mitigation, disable zlib compression by setting
net.compression.compressors to snappy,zstd or disabled in the configuration.
Restrict access to the MongoDB server through firewall rules to ensure it is not publicly accessible.
Rotate database credentials and secrets that may have been exposed in memory.Exploit
Fix
DoS
RCE
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Linuxmint
Mongodb Server
Mongodb
Red Os
Ubuntu