PT-2025-52440 · Mongodb+3 · Mongodb Server+4

Alan Coopersmith · Published 2025-12-19 · Updated 2026-04-28 · CVE-2025-14847

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions MongoDB versions 3.6 through 8.2.3

Description MongoDB is vulnerable to a critical remote code execution (RCE) vulnerability (CVE-2025-14847), dubbed "MongoBleed." This flaw stems from improper handling of zlib-compressed protocol headers, allowing unauthenticated attackers to read uninitialized heap memory. This can lead to the leakage of sensitive information, including credentials, API keys, and other secrets. The vulnerability is actively exploited in the wild, with over 87,000 servers potentially affected. A public proof-of-concept (PoC) exploit is available, increasing the risk of widespread exploitation. The vulnerability affects MongoDB versions 3.6 through 8.2.3. Multiple reports indicate active exploitation by threat actors, with some sources suggesting potential data breaches and compromised systems.

Recommendations MongoDB versions prior to 8.2.3 are vulnerable. Upgrade to version 8.2.3 or later to address this vulnerability. If immediate patching is not possible, disable zlib compression. Implement strict network segmentation to limit exposure. Conduct comprehensive audits of potentially compromised systems. Monitor for unusual unauthenticated traffic.

Exploit

Fix

RCE

Weakness Enumeration

CWE-130

Related Identifiers

BDU:2025-16225

BIT-MONGODB-2025-14847

CLEANSTART-2026-AT88149

CLEANSTART-2026-DT95939

CLEANSTART-2026-ON55906

CLEANSTART-2026-RG55910

CLEANSTART-2026-RN77098

CLEANSTART-2026-RS39538

CVE-2025-14847

USN-8160-1

Affected Products

Linuxmint

Mongodb Server

Mongodb

Red Os

Ubuntu

References · 618

• 🔥 https://vicarius.io/vsociety/posts/cve-2025-14847-detection-script-heap-memory-exposure-in-mongodb-server · Exploit
• 🔥 https://vicarius.io/vsociety/posts/cve-2025-14847-mitigation-script-heap-memory-exposure-in-mongodb-server · Exploit
• https://osv.dev/vulnerability/USN-8160-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-14847 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-8160-1 · Vendor Advisory
• https://osv.dev/vulnerability/CLEANSTART-2026-RS39538 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-58181 · Security Note
• https://osv.dev/vulnerability/CLEANSTART-2026-RG55910 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2025-14847 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-14847 · Security Note
• https://ubuntu.com/security/CVE-2025-14847 · Vendor Advisory
• https://osv.dev/vulnerability/CLEANSTART-2026-AT88149 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-16225 · Security Note
• https://osv.dev/vulnerability/CLEANSTART-2026-RN77098 · Vendor Advisory
• https://osv.dev/vulnerability/CLEANSTART-2026-ON55906 · Vendor Advisory