Mongobleed PoC Exploit Tool Released for MongoDB Flaw that Exposes Sensitive Data

A critical unauthenticated memory-leak vulnerability (CVE-2025-14847) in MongoDB's zlib decompression handling allows remote attackers to cause the server to treat uninitialized buffer memory as valid BSON data; the public Python PoC 'mongobleed' automates probing offsets to exfiltrate fragments such as system metrics, logs, Docker paths, and connection identifiers. Multiple MongoDB branches (5.0 through 8.2) are listed as affected with fixed releases available; operators are advised to patch, disable unauthenticated access, and monitor for scans on port 27017.