Over 74,000 MongoDB database servers remain vulnerable to a critical security flaw following the public release of proof-of-concept exploit code for CVE-2025-14847.
The Shadowserver Foundation reports that 74,854 exposed MongoDB instances are running unpatched versions of the database software, representing 95% of all exposed MongoDB servers currently online.
Vulnerability Overview
| Attribute | Details |
|---|---|
| CVE ID | CVE-2025-14847 |
| Vulnerability Name | MongoBleed |
| Severity | Critical |
| CVSS Score | High |
| Attack Vector | Network |
| Authentication Required | No |
| Impact | Heap Memory Disclosure |
| Affected Component | Zlib Compression Implementation |
MongoBleed exploits a critical flaw in MongoDB’s zlib compression implementation, allowing unauthenticated attackers to read uninitialized heap memory.
The vulnerability stems from a length-field mismatch in Zlib-compressed protocol headers, enabling threat actors to extract sensitive data directly from server memory without authentication credentials.
MongoDB has confirmed active exploitation in the wild. The vulnerability impacts multiple versions spanning several years, from v3.6 through the current 8.2.x releases.
| Version Range | Vulnerable Versions |
|---|---|
| 8.x Series | 8.2.0 – 8.2.3, 8.0.0 – 8.0.16 |
| 7.x Series | 7.0.0 – 7.0.26 |
| 6.x Series | 6.0.0 – 6.0.26 |
| 5.x Series | 5.0.0 – 5.0.31 |
| 4.x Series | 4.4.0 – 4.4.29, All 4.2.x, All 4.0.x |
| Legacy | All 3.6.x versions |
MongoDB released emergency patches addressing the vulnerability. Organizations must immediately upgrade to patched versions: 8.2.3, 8.0.17, 7.0.28, 6.0.27, 5.0.32, or 4.4.30.
For systems requiring immediate deployment windows, MongoDB recommends disabling zlib compression as a temporary workaround.
Administrators should configure network message compressors to “snappy,zstd” or “disabled” when launching mongod or mongos services.
Security researchers emphasize that many MongoDB deployments compound vulnerability risks by lacking proper authentication mechanisms.
The Shadowserver Foundation has implemented version-based tagging to identify vulnerable instances and shares IP addresses via its Open MongoDB Report.
Organizations operating MongoDB infrastructure should verify patch status immediately and enable authentication if not already configured.
The combination of unpatched systems and disabled authentication creates a severe risk of data breaches and memory-exploitation attacks.
Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyber Press as a Preferred Source in Google.
%20(1).webp?fit=1600,900&ssl=1&description=The Shadowserver Foundation reports that 74,854 exposed MongoDB instances are running unpatched versions of the database software){kind=link}