CVE-2025-14847

mongoExploit CVE-2025-14847 mongoExploit is a Proof-of-Concept PoC exploit tool for CVE-2025-14847 , a memory leak vulnerability in MongoDB. This tool exploits a bug in zlib decompression to leak server memory via BSON field names. By crafting a BSON payload with an inflated document length, it...

psa-2026-00043-recovery

psa-2026-00043-recovery Recovering from a wiper that presented as ransomware, after an attack against internet-exposed Proxmox infrastructure PSA-2026-00043-1 / CVE-2023-54391. The attacker wiped guests and left the filesystems damaged. Two recovery tracks depending on what the guest was: databas...

CVE-2025-14847-MongoDB

CVE-2025-14847-MongoDB Memory Disclosure Research Tool Overview This repository contains an educational research tool designed to demonstrate the memory safety concepts behind CVE-2025-14847, a critical vulnerability discovered in MongoDB's BSON decompression implementation. The tool simulates ho...

CVE-2025-61301

CVE-2025-61301 - CAPEv2: Denial-Of-Analysis via Recursive Process Forking Description A High-Severity Denial-of-analysis vulnerability affects reporting/mongodb.py and reporting/jsondump.py in CAPEv2 commit 52e4b43, on 2025-05-17 allows attackers who can submit samples to cause incomplete or...

CVE-2025-14847---MongoBleed

Mongobleed CVE-2025-14847 – Go Proof of Concept This repository contains a Go proof-of-concept exploit for CVE-2025-14847 , a MongoDB memory disclosure vulnerability commonly referred to as Mongobleed. This PoC is a Go reimplementation of the original Python exploit by Joe Desimone , available...

CVE-2026-114651

A memory-handling weakness in the BSON deserialization component of the MongoDB C Driver may cause data left over from previously processed content to be returned when specially crafted serialized input is parsed. An unauthenticated party able to supply serialized data to an application that maps...

CVE-2026-114654

A numeric-type conversion flaw in the BSON handling library of the MongoDB C Driver allows an out-of-range binary subtype value supplied through untrusted textual input to bypass the library's binary-element integrity checks. When such a value is later encoded, it is narrowed to a smaller wire...

CVE-2026-114644

The MongoDB C Driver's BSON library contains an uncontrolled resource consumption weakness in its deserialization handling of one BSON value type. An application that deserializes untrusted content with the library retains data derived from that content for the lifetime of the process, with no...

CVE-2026-114646

A data-validation flaw exists in the BSON handling and binary serialization path of the MongoDB C Driver. When an application constructs a raw or lazy BSON document object from externally supplied binary data, the driver does not verify that the size quantity declared inside that data matches the...

CVE-2026-114654

The MongoDB C# Driver contains a numeric-type conversion flaw in its BSON handling library . An unauthenticated party can provide untrusted textual input containing an out-of-range binary subtype value , which bypasses integrity checks. During subsequent encoding, the value is narrowed to a small...

CVE-2026-114654 BSON output corruption via out-of-range binary subtype bypassing UUID and OldBinary guards

A numeric-type conversion flaw in the BSON handling library of the MongoDB C Driver allows an out-of-range binary subtype value supplied through untrusted textual input to bypass the library's binary-element integrity checks. When such a value is later encoded, it is narrowed to a smaller wire...

CVE-2026-114654 BSON output corruption via out-of-range binary subtype bypassing UUID and OldBinary guards

A numeric-type conversion flaw in the BSON handling library of the MongoDB C Driver allows an out-of-range binary subtype value supplied through untrusted textual input to bypass the library's binary-element integrity checks. When such a value is later encoded, it is narrowed to a smaller wire...

EUVD-2026-108328

A numeric-type conversion flaw in the BSON handling library of the MongoDB C Driver allows an out-of-range binary subtype value supplied through untrusted textual input to bypass the library's binary-element integrity checks. When such a value is later encoded, it is narrowed to a smaller wire...

CVE-2026-114654

A numeric-type conversion flaw in the BSON handling library of the MongoDB C Driver allows an out-of-range binary subtype value supplied through untrusted textual input to bypass the library's binary-element integrity checks. When such a value is later encoded, it is narrowed to a smaller wire...

CVE-2026-114651 Cross-document data leak via malformed BSON array parsing in reused thread buffer

A memory-handling weakness in the BSON deserialization component of the MongoDB C Driver may cause data left over from previously processed content to be returned when specially crafted serialized input is parsed. An unauthenticated party able to supply serialized data to an application that maps...

CVE-2026-114651

A memory-handling weakness in the BSON deserialization component of the MongoDB C# Driver allows for potential data leakage. By providing specially crafted serialized input, an unauthenticated party can cause the application to return residual bytes from unrelated data processed earlier on the sa...

EUVD-2026-108322

A memory-handling weakness in the BSON deserialization component of the MongoDB C Driver may cause data left over from previously processed content to be returned when specially crafted serialized input is parsed. An unauthenticated party able to supply serialized data to an application that maps...

CVE-2026-114651 Cross-document data leak via malformed BSON array parsing in reused thread buffer

A memory-handling weakness in the BSON deserialization component of the MongoDB C Driver may cause data left over from previously processed content to be returned when specially crafted serialized input is parsed. An unauthenticated party able to supply serialized data to an application that maps...

CVE-2026-114646 NoSQL command injection via mismatched raw BSON length prefix written verbatim to the wire

A data-validation flaw exists in the BSON handling and binary serialization path of the MongoDB C Driver. When an application constructs a raw or lazy BSON document object from externally supplied binary data, the driver does not verify that the size quantity declared inside that data matches the...

CVE-2026-114646 NoSQL command injection via mismatched raw BSON length prefix written verbatim to the wire

A data-validation flaw exists in the BSON handling and binary serialization path of the MongoDB C Driver. When an application constructs a raw or lazy BSON document object from externally supplied binary data, the driver does not verify that the size quantity declared inside that data matches the...