VulnRadar

Data against noise.

Built with NaN
Page generated: 09 Nov 2026, 11:07 UTC
← Dashboard

CVE-2025-14847

MongoBleed

Mismatched length fields in Zlib compressed protocol headers may allow a read of uninitialized heap memory by an unauthenticated client. This issue affects all MongoDB Server v7.0 prior to 7.0.28 versions, MongoDB Server v8.0 versions prior to 8.0.17, MongoDB Server v8.2 versions…

Read full description
Mismatched length fields in Zlib compressed protocol headers may allow a read of uninitialized heap memory by an unauthenticated client. This issue affects all MongoDB Server v7.0 prior to 7.0.28 versions, MongoDB Server v8.0 versions prior to 8.0.17, MongoDB Server v8.2 versions prior to 8.2.3, MongoDB Server v6.0 versions prior to 6.0.27, MongoDB Server v5.0 versions prior to 5.0.32, MongoDB Server v4.4 versions prior to 4.4.30, MongoDB Server v4.2 versions greater than or equal to 4.2.0, MongoDB Server v4.0 versions greater than or equal to 4.0.0, and MongoDB Server v3.6 versions greater than or equal to 3.6.0.
CVSS 7.5 (HIGH) KEV: KNOWN CATALOG

Attention and evidence

HYPE SCORE
3.8/10
REALITY · THREAT PRIORITY
8.5/10
General review priority; not probability

Evidence confidence: Exploitation recorded

Why this priority?
  • Recorded exploitation baseline: +7.00
  • Technical severity: CVSS 7.5: +1.12
  • Fresh EPSS: 83.22%: +0.42

General review priority, not probability, victim count or asset-specific risk. A range covers missing CVSS/EPSS inputs within the current evidence state.

Sources: 31 documents and public datasets.

Hype components

Headline sample (25%)
80/100
Press, 30 days (60%)
5/100
Grounded branding (15%)
100/100
HYPE TOTAL38/100

Sources and documents

shattered.io
Press · 20 Oct 2026, 04:06 · MongoBleed Bug Exposes 87K Servers After R6 Hack [2026] - shattered.io
Recorded Future
Press · 13 Jan 2026, 08:00 · December 2025 CVE Landscape: 22 Critical Vulnerabilities Mark 120% Surge, React2Shell Dominates Threat Activity - Recorded Future
Unit 42
Press · 13 Jan 2026, 08:00 · Threat Brief: MongoDB Vulnerability (CVE-2025-14847) - Unit 42
SOC Prime
Press · 08 Jan 2026, 08:00 · MongoBleed CVE-2025-14847: Detecting Memory Leak Abuse - SOC Prime
heise online
Press · 31 Dec 2025, 08:00 · MongoBleed: Over 11,500 Vulnerable MongoDB Instances in Germany - heise online
See all 31 source documents
BankInfoSecurity
Press · 30 Dec 2025, 08:00 · 75,000 MongoDBs Exposed as Attackers Exploit 'MongoBleed' - BankInfoSecurity
Resecurity
Press · 30 Dec 2025, 08:00 · MongoBleed (CVE-2025-14847): MongoDB Memory Leak Flaw - Resecurity
Akamai
Press · 30 Dec 2025, 08:00 · CVE-2025-14847: All You Need to Know About MongoBleed - Akamai
Cybernews
Press · 29 Dec 2025, 08:00 · Christmas gift: method to exploit MongoBleed vulnerability leaking MongoDB secrets showcased on web - Cybernews
OX Security
Press · 29 Dec 2025, 08:00 · PoC: Exploiting MongoBleed, CVE-2025-14847 | Technical Walkthrough - OX Security
Rapid7
Press · 29 Dec 2025, 08:00 · MongoBleed CVE-2025-1484: Critical Memory Leak in MongoDB Allowing Attackers to Extract Sensitive Data - Rapid7
CyberSecurityNews
Press · 29 Dec 2025, 08:00 · MongoBleed Detector Tool Released to Detect MongoDB Vulnerability(CVE-2025-14847) - CyberSecurityNews
CyberScoop
Press · 29 Dec 2025, 08:00 · MongoBleed defect swirls, stamping out hope of year-end respite - CyberScoop
The Hacker News
Press · 29 Dec 2025, 08:00 · MongoDB Vulnerability CVE-2025-14847 Under Active Exploitation Worldwide - The Hacker News
The Record from Recorded Future News
Press · 29 Dec 2025, 08:00 · US, Australia say ‘MongoBleed’ bug being exploited - The Record from Recorded Future News
SecurityWeek
Press · 29 Dec 2025, 08:00 · Fresh MongoDB Vulnerability Exploited in Attacks - SecurityWeek
SiliconANGLE
Press · 29 Dec 2025, 08:00 · US and Australian agencies warn MongoBleed vulnerability in MongoDB is under active exploitation - SiliconANGLE
Bitsight
Press · 29 Dec 2025, 08:00 · Security Alert: CVE-2025-14847 MongoDB “MongoBleed” Actively Exploited - Bitsight
Tom's Guide
Press · 28 Dec 2025, 08:00 · Massive Rainbow Six Siege breach reportedly linked to MongoBleed flaw — everything you need to know - Tom's Guide
CyberSecurityNews
Press · 28 Dec 2025, 08:00 · 87,000+ MongoDB Instances Vulnerable to MongoBleed Flaw Exposed Online - PoC Exploit Released - CyberSecurityNews
CyberSecurityNews
Press · 28 Dec 2025, 08:00 · MongoBleed (CVE-2025-14847) Now Exploited in the Wild: MongoDB Servers at Critical Risk - CyberSecurityNews
wiz.io
Press · 28 Dec 2025, 08:00 · MongoBleed (CVE-2025-14847) exploited in the wild: everything you need to know - wiz.io
BleepingComputer
Press · 28 Dec 2025, 08:00 · Exploited MongoBleed flaw leaks MongoDB secrets, 87K servers exposed - BleepingComputer
Rescana
Press · 28 Dec 2025, 08:00 · Rainbow Six Siege Massive Breach: MongoBleed Exploit Leads to Unauthorized Distribution of Billions of In-Game Credits - Rescana
CyberSecurityNews
Press · 27 Dec 2025, 08:00 · Mongobleed PoC Exploit Tool Released for MongoDB Flaw that Exposes Sensitive Data - CyberSecurityNews
The Hacker News
Press · 27 Dec 2025, 08:00 · New MongoDB Flaw Lets Unauthenticated Attackers Read Uninitialized Memory - The Hacker News
Aikido Security
Press · 26 Dec 2025, 08:00 · MongoBleed: MongoDB Zlib Vulnerability (CVE-2025-14847) and How to Fix It - Aikido Security
DoublePulsar
Press · 26 Dec 2025, 08:00 · Merry Christmas Day! Have a MongoDB security incident. - DoublePulsar
BleepingComputer
Press · 24 Dec 2025, 08:00 · MongoDB warns admins to patch severe vulnerability immediately - BleepingComputer
OX Security
Press · 24 Dec 2025, 08:00 · MongoDB Unauthenticated Attacker Sensitive Memory Leak - OX Security
Arctic Wolf
Press · 19 Dec 2025, 08:00 · CVE-2025-14847: MongoBleed Information Disclosure Vulnerability Exploited in the Wild - Arctic Wolf

Score evolution

● Hype   ● Reality

Earlier evidence-support scores are retained in history; this chart shows only the current priority definition.

First record: hype 3.8 · reality 8.5 (2026-11-02 15:13). The curve appears once the score changes.

Public exploit evidence

7

Public exploit entries / repo candidates

See 7 repos with metrics
RepositoryStarsForksLanguageUpdated
ProbiusOfficial/CVE-2025-14847276Python26 Dec 2025, 09:27
codeb0ssx/CVE-2025-14847-PoC40Python29 Dec 2025, 09:26
FurkanKAYAPINAR/CVE-2025-14847-MongoBleed-Exploit10Python02 Jan 2026, 10:45
NoNameError/MongoBLEED---CVE-2025-14847-POC-10Python30 Dec 2025, 23:42
SAIM28826/CVE-2025-14847-poc10Python22 Oct 2026, 03:21
ElJoamy/MongoBleed-exploit00Python05 Jan 2026, 17:32
im-hanzou/mongobleed00—05 Jan 2026, 14:56
Evidence context and dated references

Reality is general threat/review priority, combining observed exploitation, CVSS severity and fresh EPSS. Evidence confidence is separate. This is not calibrated risk, a victim count or an asset-specific assessment. A range reflects missing numeric inputs.

Evidence in context

Confidence in exploitation evidence
Exploitation recorded
Priority basis
Recorded exploitation; CVSS 7.5; EPSS 83.2%
Attention, last 30 days
1 distinct story titles; 1 press documents; 1 publisher domains.
Technical potential
network access, no prior privileges, no user interaction.
Observed activity
Exploitation recorded in CISA KEV.
Known scale
Not quantified.
Evidence confidence basis
Trusted exploitation confirmation

Score evaluated: 2026-11-05 13:59:28.494260+00:00 · EPSS snapshot: 2026-11-05T12:03:04Z

Source event timeline
First press mention
19 Dec 2025, 08:00
Published
19 Dec 2025, 11:00
Added to the CISA KEV catalog
29 Dec 2025, 00:00
Latest press mention
20 Oct 2026, 04:06
Score calculated
05 Nov 2026, 13:59
Name
MongoBleed
PoCs on GitHub
7 repositories
Source: CVE List V5 · CISA KEV · FIRST EPSS · GitHub · RSSVulnRadar