US, Australia say ‘MongoBleed’ bug being exploited

U.S. and Australian agencies confirmed active exploitation of CVE-2025-14847 (dubbed "MongoBleed") in MongoDB servers; public exploit code has been published and researchers report the bug allows attackers to make many rapid connections to trigger memory leaks and reconstruct sensitive data, with tens of thousands of potentially vulnerable internet-facing instances observed and advisories urging rapid patching.