CVE-2025-14847

CVE-2025-14847 CVE-2025-14847 vulnerability environment with a PoC https://jira.mongodb.org/browse/SERVER-115508 SUMMARY This is a critical fix to address CVE-2025-14847. Upgrade to 8.2.3, 8.0.17, 7.0.28, 6.0.27, 5.0.32, or 4.4.30. ISSUE DESCRIPTION AND IMPACT An client-side exploit of the Server...

mongobleed

mongobleed CVE-2025-14847 - MongoDB Unauthenticated Memory Leak Exploit A proof-of-concept exploit for the MongoDB zlib decompression vulnerability that allows unauthenticated attackers to leak sensitive server memory. Vulnerability A flaw in MongoDB's zlib message decompression returns the...

mongoaudit

mongoaudit is a CLI tool for auditing MongoDB servers, detecting poor security settings and performing automated penetration testing. Installing Clone this repository and run the setup: git clone https://github.com/stampery/mongoaudit.git cd mongoaudit python setup.py install mongoaudit...

CVE-2025-14847-MongoBleed-Exploit

CVE-2025-14847 - MongoBleed 👨‍💻 Author: Furkan KAYAPINAR @FurkanKAYAPINAR ⚠️ EDUCATIONAL PURPOSE ONLY Lab environment and exploit script for the critical unauthenticated memory-leak vulnerability in MongoDB Server. 📋 Table of Contents Vulnerability Overview Affected Versions Installation Lab...

CVE-2025-14847-MongoBleed

CVE-2025-14847 MongoBleed MongoDB zlib Compression Memory Disclosure — Analysis, Detection, and Remediation Overview CVE-2025-14847, commonly referred to as MongoBleed , is a high-severity information disclosure vulnerability affecting :contentReferenceoaicite:0index=0 Server. The vulnerability...

CVE-2025-14847

🍃 CVE-2025-14847 — MongoBleed 🍃 MongoBleed — MongoDB Server Memory Disclosure Vulnerability 🍃 Overview CVE-2025-14847, known as MongoBleed , is a security vulnerability affecting MongoDB Server's handling of compressed network messages. Under vulnerable conditions, an unauthenticated remote...

Linux Distros Unpatched Vulnerability : CVE-2026-104004

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - MongoDB Server's collection validation feature may not properly handle certain expressions stored in a validator. In some cases, this can cause the server proce...

Linux Distros Unpatched Vulnerability : CVE-2026-96297

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Use of freed memory in the aggregation feature of MongoDB Server can cause the server to read data from a memory area after it has been released. When an intern...

Linux Distros Unpatched Vulnerability : CVE-2026-103965

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An issue in MongoDB Server's aggregation framework can cause certain constant values to be handled incorrectly during internal query rewriting. Under certain...

CVE-2026-8053-MongoDB

CVE-2026-8053 — MongoDB Server Out-of-Bounds Write Overview Attribute| Value ---|--- CVE ID| CVE-2026-8053 Technical Name| FlatBSON Duplicate Field Index Drift Vulnerability Type| CWE-787 — Out-of-bounds Write CVSS v4.0| 8.7 HIGH CVSS v3.1| 8.8 HIGH EPSS| 0.064% 20th percentile — low exploitation...

CVE-2026-96297

Use of freed memory in the aggregation feature of MongoDB Server can cause the server to read data from a memory area after it has been released. When an internal aggregation stage is combined with a batch size of 0, the server may read from memory that is no longer in use. Because that memory ca...

CVE-2026-96299

A security issue was discovered in MongoDB mongos the sharded cluster router where an authenticated user with readWrite privileges could crash the mongos process by crafting a specially formed aggregation pipeline. The issue leverages an internal aggregation stage that lacks proper authorization...

CVE-2026-104005

A security issue was discovered in MongoDB mongos the sharded cluster router where an authenticated user with readWrite privileges could crash the mongos process by crafting a specially formed aggregation pipeline. The issue leverages an internal aggregation stage that lacks proper authorization...

CVE-2026-103965

An issue in MongoDB Server's aggregation framework can cause certain constant values to be handled incorrectly during internal query rewriting. Under certain conditions, an authenticated user with read access may receive field values in aggregation output that the query did not intend to return...

CVE-2026-104004

MongoDB Server's collection validation feature may not properly handle certain expressions stored in a validator. In some cases, this can cause the server process to stop running when a document is later inserted. The behavior can occur for authenticated users with write access...

CVE-2026-104004

MongoDB Server's collection validation feature may not properly handle certain expressions stored in a validator. In some cases, this can cause the server process to stop running when a document is later inserted. The behavior can occur for authenticated users with write access...

CVE-2026-96297

Use of freed memory in the aggregation feature of MongoDB Server can cause the server to read data from a memory area after it has been released. When an internal aggregation stage is combined with a batch size of 0, the server may read from memory that is no longer in use. Because that memory ca...

UBUNTU-CVE-2026-104004

MongoDB Server's collection validation feature may not properly handle certain expressions stored in a validator. In some cases, this can cause the server process to stop running when a document is later inserted. The behavior can occur for authenticated users with write access...

CVE-2026-104005

A security issue in MongoDB mongos (sharded cluster router) allows an authenticated user with readWrite privileges to cause a Denial of Service (DoS) . By crafting a specially formed aggregation pipeline, an attacker can trigger an unhandled fatal error in an internal aggregation stage that lacks...

CVE-2026-104005 Incorrect authorization in MongoDB Server router for bulk writes to system namespaces

A security issue was discovered in MongoDB mongos the sharded cluster router where an authenticated user with readWrite privileges could crash the mongos process by crafting a specially formed aggregation pipeline. The issue leverages an internal aggregation stage that lacks proper authorization...