87K MongoDB Servers Exposed by Critical Flaw
▼ Summary
– A critical vulnerability (CVE-2025-14847) called MongoBleed is being actively exploited, allowing attackers to remotely extract sensitive data like credentials from vulnerable MongoDB servers.
– The flaw exists in how MongoDB’s zlib compression handles network packets, leaking in-memory data because the server returns allocated memory size instead of decompressed data length.
– Exploitation does not require authentication, and over 87,000 potentially vulnerable MongoDB instances are exposed on the public internet.
– A patch has been available since December 19, and MongoDB strongly recommends upgrading to fixed versions, as there is no workaround other than disabling zlib compression.
– Security researchers have observed exploitation in the wild and recommend immediate patching alongside checking for signs of compromise using available detection methods.
A critical security vulnerability in MongoDB, known as MongoBleed, is currently under active exploitation, putting tens of thousands of database servers at risk of having sensitive data stolen. The flaw, officially tracked as CVE-2025-14847, carries a high severity rating and allows attackers to remotely extract secrets from vulnerable systems without needing any authentication. Security researchers report that over 87,000 MongoDB instances are currently exposed on the public internet, making them prime targets for this attack.
The core of the MongoBleed vulnerability lies in how the MongoDB server processes network packets using the zlib compression library. The problem occurs because the server incorrectly returns the amount of memory it allocated for a task instead of the actual length of the decompressed data. This mistake creates an opportunity for exploitation. An attacker can send a specially crafted network message that claims a large size upon decompression. This tricks the server into allocating a bigger memory buffer than needed. The excess memory, which can contain leftover sensitive information, is then sent back to the attacker’s client.
This leaked data can include a wide array of critical secrets. Compromised information may encompass database credentials, cloud access keys, API tokens, session data, and personally identifiable information (PII). Because the flawed decompression process happens before user authentication, attackers can pull this data without needing a valid username or password. A public proof-of-concept exploit tool, also named “MongoBleed,” has been released, confirming the attack’s effectiveness. Security experts note the tool only requires a target server’s IP address to begin extracting plain-text passwords and other confidential details from memory.
The scale of exposure is significant. Internet scans show nearly 87,000 potentially vulnerable MongoDB servers accessible online, with high concentrations in the United States, China, and Germany. The impact extends deeply into cloud environments as well; telemetry indicates that 42% of visible systems in one study had at least one instance running a vulnerable MongoDB version. Researchers have already observed active exploitation in the wild, and some threat actors are claiming to have used this flaw in recent breaches, underscoring the urgency for organizations to respond.
Addressing this threat requires more than just applying the available patch. While upgrading to a fixed version is the primary solution, security teams must also hunt for signs of a compromise. One detection method involves monitoring for suspicious connection patterns, such as a single source IP establishing hundreds of connections without generating normal metadata logs. However, experts caution that sophisticated attackers could modify their tools to evade this basic detection. Specialized tools, like the MongoBleed Detector, have been created to parse server logs and identify exploitation attempts linked to CVE-2025-14847.
MongoDB released patches for this critical flaw on December 19th. Administrators are strongly urged to upgrade their self-hosted deployments to a secure release immediately. The affected versions span many years of releases, from legacy v3.6 up to recent versions like 8.2.0. For users of MongoDB Atlas, the managed cloud service, patches were applied automatically and no action is required. For those who cannot upgrade immediately, the only workaround is to disable zlib compression on the server entirely, though this may impact performance. The company suggests considering alternative compression libraries like Zstandard or Snappy, which are not affected by this specific vulnerability.
(Source: Bleeping Computer)
