Kudelski Security Research Center

CVE-2025-14847 (MongoBleed) is a high-severity pre-auth memory disclosure in MongoDB's zlib-compressed network handling that can return uninitialized heap memory to unauthenticated remote attackers, exposing database credentials, cloud keys, API tokens, and other sensitive data; a public exploit has been released and many self-hosted versions across multiple major releases are affected. The advisory lists affected versions, detection indicators (large connection volumes and unexpected leakage), immediate mitigations (patching to fixed versions, disabling zlib, restricting network exposure, enforcing TLS/authentication), and recommends inventory, prioritisation, and secrets rotation.