CVE-2025-14847

CVE-2025-14847 CVE-2025-14847 脆弱性環境に付属のPoC https://jira.mongodb.org/browse/SERVER-115508 概要 これは CVE-2025-14847 に対処するための重要な修正です。バージョン 8.2.3、8.0.17、7.0.28、6.0.27、5.0.32、または 4.4.30 にアップグレードしてください。 問題の説明と影響 サーバーの zlib...

mongoaudit

mongoaudit is a CLI tool for auditing MongoDB servers, detecting poor security settings and performing automated penetration testing. Installing Clone this repository and run the setup: git clone https://github.com/stampery/mongoaudit.git cd mongoaudit python setup.py install mongoaudit...

CVE-2025-14847-MongoBleed-Exploit

CVE-2025-14847 - MongoBleed 👨‍💻 著者: Furkan KAYAPINAR @FurkanKAYAPINAR ⚠️ 教育目的専用 MongoDB Server における認証不要の重大なメモリリーク脆弱性のためのラボ環境とエクスプロイトスクリプトです。 📋 目次 脆弱性の概要 影響を受けるバージョン インストール ラボ環境 使用方法 修正方法 法的免責事項 🔴 脆弱性の概要 CVE-2025-14847 MongoBleed は、MongoDB Server の zlib 圧縮処理における、認証不要の重大なメモリリーク脆弱性です。 属性| 値 ---|---...

BIT-MONGODB-2026-89099 Race Condition in MongoDB Server Document Value Layer Leads to Memory Corruption

A race condition in the document value layer of MongoDB Server can allow concurrent server threads to operate on the same internal memory without synchronization, leading to memory corruption. An authenticated user holding ordinary read-write privileges on a database may be able to trigger this...

CVE-2025-14847-MongoBleed

CVE-2025-14847 MongoBleed MongoDB zlib圧縮メモリ開示 — 分析、検出、および修正 概要 CVE-2025-14847は、一般にMongoBleed と呼ばれる、:contentReferenceoaicite:0index=0 Server に影響を与える高深刻度の情報漏洩脆弱性です。 この脆弱性により、リモートの未認証攻撃者 が、zlib圧縮されたネットワークメッセージの不適切な処理を悪用して、サーバーメモリから機密データを漏洩させる可能性があります。...

CVE-2026-8053-MongoDB

CVE-2026-8053 — MongoDB Server の領域外書き込み 概要 属性| 値 ---|--- CVE ID| CVE-2026-8053 技術名| FlatBSON Duplicate Field Index Drift 脆弱性タイプ| CWE-787 — 領域外書き込み Out-of-bounds Write CVSS v4.0| 8.7 HIGH CVSS v3.1| 8.8 HIGH EPSS| 0.064% 20th パーセンタイル — 悪用の可能性は低い KEV 既知の悪用| 記録なし 発見日| MongoDB 内部 公開日| 12/05/2026 予約日|...

BIT-MONGODB-2026-18712 Improper Authorization in MongoDB Queryable Encryption Maintenance Operations Allows Unauthorized Modification of Other Collections

An issue in MongoDB Server's Queryable Encryption maintenance operations could allow an authenticated user with privileges on one encrypted collection to cause unauthorized modification or destruction of data belonging to a different collection. This is due to insufficient validation of certain...

BIT-MONGODB-2026-18711 Use-After-Free in MongoDB Query Execution Engine Leads to Denial of Service and Potential Memory Disclosure

An issue in MongoDB Server's query execution engine could allow an authenticated user with read and write privileges to cause an internal reference to be used after the underlying memory has been freed, when running certain queries against time-series collections. This could result in a server...

CVE-2025-14847

🚨 CVE-2025-14847 — “MongoBleed” 未認証のメモリ開示脆弱性（高深刻度） 📖 目次 概要 技術的詳細 深刻度とCVSS 影響を受けるバージョン 実際の影響 悪用の概要 検出の手引き 修復 一時的な緩和策 セキュリティチェックリスト まとめ 🔎 概要 CVE-2025-14847 （通称 “MongoBleed” ）は、MongoDB Serverのネットワークプロトコル処理における脆弱性です。 リモートの未認証攻撃者 が、脆弱なMongoDBプロセスの未初期化ヒープメモリ を読み取ることを可能にします。 これにより、以下のような機密情報が漏洩する可能性がありま...

CVE-2025-14847

CVE-2025-14847 MongoBleed 📜 説明 このスクリプトは、MongoDB Server における ヒープメモリ開示脆弱性 （CVE-2025-14847 、"MongoBleed"）を悪用するために設計されています。 細工された zlib 圧縮 OPMSG パケットを、誇張されたドキュメント長で送信することで、サーバーに未初期化のヒープメモリを応答に返させるように仕向けます。これにより、以下のような機密情報が漏洩する可能性があります。 スクリプトは様々なオフセットでプローブを連続的に送信し、新たに観測された漏洩文字列...

BIT-MONGODB-2026-8843 Calling createIndex with certain index types can crash mongod

Creating a "2dspherebucket" index on a non-timeseries bucket collection will succeed, but any subsequent attempt to insert a document which triggers updating that index will crash the server. A similar issue occurs when creating "queryableencryptedrange" indices. This issue affects MongoDB Server...

PT-2026-98997

Creating a "2dsphere bucket" index on a non-timeseries bucket collection will succeed, but any subsequent attempt to insert a document which triggers updating that index will crash the server. A similar issue occurs when creating "queryable encrypted range" indices. This issue affects MongoDB...

BIT-MONGODB-2026-82074 Incorrect Authorization in MongoDB Server Aggregation Framework Allows Unauthorized Read Access to Collection Data

MongoDB Server contains an incorrect authorization vulnerability in the aggregation framework. An authenticated user with minimal privileges can craft a specially formatted aggregation request that causes the server's authorization subsystem to evaluate a different operation than what is actually...

BIT-MONGODB-2026-82073 Improper Validation in MongoDB Server Aggregation Framework Allows Authorization Bypass and Unauthorized Collection Access with Atlas Search

A security issue in the MongoDB Server aggregation framework allows an authenticated user with limited read privileges to bypass view-level authorization checks and access data from unauthorized collections when Atlas Search features are in use. The issue stems from insufficient validation of an...

BIT-MONGODB-2026-82071 Insufficient Validation of Storage Engine Configuration Options in MongoDB Server Leads to Out-of-Bounds Write

Insufficient validation of storage engine configuration options in MongoDB Server allows an authenticated user with write privileges to supply crafted parameters during collection creation that override internal storage metadata. This results in an out-of-bounds memory write in the server process...

BIT-MONGODB-2026-82070 Insufficiently Protected Credentials in MongoDB Server Diagnostic Reporting Interface

A security issue in MongoDB Server's diagnostic reporting interface allows an authenticated user with monitoring privileges to access insufficiently protected credentials from concurrent administrative operations. The same credentials are properly redacted in server log output, but the diagnostic...

BIT-MONGODB-2026-82069 Improper Redaction of Query Literals in MongoDB Server Query Statistics Serialization on Sharded Cluster Router

A security issue in MongoDB Server's query statistics serialization on the router allows users with monitoring privileges to access unredacted search query text from other users' operations. An improper conditional check in the serialization logic causes the data redaction mechanism to be bypasse...

BIT-MONGODB-2026-82068 Persistent Fatal Assertion Crash in MongoDB Server via Crafted Retryable Write Commands Leads to Denial of Service

A security issue in MongoDB Server allows an authenticated user with write privileges to trigger a persistent fatal assertion crash by sending specially crafted retryable write commands. The crash state is durably persisted, causing the server process to repeatedly crash on restart and potentiall...

BIT-MONGODB-2026-82067 Improper Case Sensitivity Handling in MongoDB Server Configuration Validation May Cause Authorization to Remain Disabled at Startup

Improper handling of case sensitivity in the configuration validation component of MongoDB Server may cause the authorization subsystem to remain in a default disabled state during server startup. An unauthenticated user with network access to a deployment where this condition occurs can perform...

BIT-MONGODB-2026-82066 Heap Out-of-Bounds Read in MongoDB Server Query Planning Component

A heap out-of-bounds read security issue exists in the query planning component of MongoDB Server. An authenticated user with database read and write privileges can trigger the security issue through crafted query operations, causing the server to read memory beyond allocated buffer boundaries. T...