MongoBleed (CVE-2025-14847): A Critical MongoDB Memory Leak Vulnerability Hidden for 8 Years

This report analyzes MongoBleed (CVE-2025-14847), a zlib-based OP_COMPRESSED decompression length-handling bug in MongoDB that can expose uninitialized heap memory to unauthenticated remote attackers; it explains the root cause, attack flow, why it remained undetected for years, documents evidence of active exploitation (CISA KEV listing and a suspected gaming service incident), and recommends immediate patching or mitigations such as disabling zlib compression and tightening network exposure and logging.