MongoBleed — CVE-2025-14847

Overview

MongoBleed (CVE-2025-14847) represents a memory disclosure vulnerability in MongoDB servers where "plaintext fragments of application data persist in MongoDB process memory." The vulnerability carries a CVSS v3.1 score of 8.7 (High severity).

The flaw stems from improper memory management during BSON decompression and buffer reuse in standard MongoDB operations, rather than from injection flaws or logic errors.

Affected Versions

MongoDB Version	Vulnerable Range	Fixed Version
8.2	8.2.0 – 8.2.2	8.2.3
8.0	8.0.0 – 8.0.16	8.0.17
7.0	7.0.0 – 7.0.27	7.0.28
6.0	6.0.0 – 6.0.26	6.0.27
5.0	5.0.0 – 5.0.31	5.0.32
4.4	4.4.0 – 4.4.29	4.4.30
4.2, 4.0, 3.6	All versions	No fix (EOL)

Technical Details

The vulnerability emerges when MongoDB processes compressed BSON payloads with network compression enabled via zlib. During decompression operations, internal memory buffers may be reused without complete clearing between operations.

Residual data from previously processed BSON documents can remain in process memory after operations complete. This leaked data can potentially be recovered through crash dumps, diagnostic tools, or forensic memory analysis.

Exposure Requirements

All conditions must be present for vulnerability manifestation:

• MongoDB runs a vulnerable version
• Network compression is enabled with zlib
• BSON documents undergo compression/decompression during normal operations
• Decompression buffers are reused without full memory clearing
• Attacker has network-level access to the MongoDB service

Exposure likelihood increases under write-heavy workloads, large BSON documents, and long-lived MongoDB processes with high buffer reuse.

Impact Assessment

Exploitation may result in partial disclosure of application data from MongoDB process memory, including fragments of previously processed BSON documents containing sensitive fields. However, MongoBleed provides no direct mechanism to request arbitrary memory contents or bypass authorization controls.

Credits

• Hamid Kashfi (@hkashfi)
• Joe Desimone (x.com/dez_)

Proof of Concept

A Node.js test environment with vulnerable MongoDB and load simulation via locust can demonstrate the vulnerability. The PoC generates sustained write-heavy database traffic to increase residual memory exposure likelihood.

Steps involve:

1. Building the test environment with Docker Compose
2. Running the MongoBleed script against the MongoDB instance
3. Simulating load with locust for several minutes
4. Analyzing binary output for sensitive JSON fragments