MongoDB Patches MongoBleed Vulnerability Across All Versions
MongoDB released critical security patches addressing CVE-2025-14847, a memory leak vulnerability under active exploitation that affects over 87,000 servers worldwide.
MongoDB's Security Engineering team disclosed CVE-2025-14847 on December 12, 2025, a critical vulnerability nicknamed "MongoBleed" that allows unauthenticated attackers to remotely leak sensitive data from MongoDB server memory. With a CVSS score of 8.7 and active exploitation confirmed by CISA on December 29, organizations are urged to patch immediately.
Technical Details and Impact
The vulnerability stems from incorrect length handling in MongoDB's zlib message decompression implementation (message_compressor_zlib.cpp). The affected code returns the allocated buffer size instead of the actual decompressed data length, allowing malformed payloads to expose adjacent heap memory. Since zlib compression is enabled by default, all MongoDB instances running affected versions are vulnerable. Successful exploitation can leak sensitive information including user credentials, passwords, and API keys.
Affected Versions and Patches
The vulnerability impacts MongoDB versions 8.2.0-8.2.2, 8.0.0-8.0.16, 7.0.0-7.0.27, 6.0.0-6.0.26, 5.0.0-5.0.31, 4.4.0-4.4.29, and all v4.2, v4.0, and v3.6 releases. MongoDB released patches in versions 8.2.3, 8.0.17, 7.0.28, 6.0.27, 5.0.32, and 4.4.30. Organizations unable to patch immediately should disable zlib compression by configuring networkMessageCompressors to omit zlib, restrict network exposure of MongoDB servers, and monitor logs for anomalous pre-authentication connections.
Related Articles
Cloudflare 2026 Threat Report: 230 Billion Daily Blocked Threats and the Rise of Credential Attacks
Cloudflare has published its inaugural annual threat report revealing the company blocks over 230 billion threats daily across 20% of global web traffic. DDoS attacks doubled year-over-year to 47.1 million incidents, with the largest reaching a record 31.4 Tbps, while bots now account for 94% of all login attempts.
HashiCorp Patches Consul Arbitrary File Read Vulnerability in Kubernetes Auth
HashiCorp has released emergency patches for Consul to address CVE-2026-2808, a medium-severity vulnerability allowing arbitrary file reads when Kubernetes authentication is enabled. The fix also adds HTTP server timeouts to prevent Slowloris denial-of-service attacks against Consul agent endpoints.
Let's Encrypt Now Issues Six-Day Certificates and IP Address Certificates via Certbot
Let's Encrypt and the EFF have announced support for six-day (160-hour) certificates and IP address certificates through Certbot 5.3 and 5.4. The ultra-short-lived certificates reduce the impact window of compromised keys by design, while IP address certificates enable HTTPS for services identified by address rather than hostname.