mongobleed-exploit-CVE-2025-14847

🩸 MongoBleed - CVE-2025-14847 Security Research Lab CVE-2025-14847 | CVSS 8.7 High | Unauthenticated Memory Disclosure CVE-2025-14847 , dubbed MongoBleed , allows unauthenticated remote attackers to exfiltrate uninitialised heap memory by exploiting MongoDB's zlib decompression logic. This...

MongoBleed

MongoBleed CVE-2025-14847 Escáner y Kit de Explotación Un kit de investigación de seguridad para MongoBleed, una fuga de memoria crítica no autenticada en la descompresión zlib de MongoDB que permite a atacantes extraer datos sensibles de la memoria heap del servidor sin autenticación...

external_zlib_AOSP10_r33_CVE-2018-25032

This repository does not have a README...

CVE-2025-14847

🚨 CVE-2025-14847 — “MongoBleed” A high-severity unauthenticated memory disclosure vulnerability 📖 Table of Contents Overview Technical Details Severity & CVSS Affected Versions Real-World Impact Exploitation Summary Detection Guidance Remediation Mitigation Temporary Security Checklist Summary 🔎...

CVE-2026-100723

vm2 before 3.12.2 does not apply its Buffer backing-store ownership invariant byteOffset === 0 and buffer.byteLength === length to Buffers returned from host builtin modules. When an application explicitly exposes Node's zlib module through NodeVM's builtin allowlist require: builtin: 'zlib' ,...

CVE-2026-100723 vm2 before 3.12.2 Memory Disclosure via zlib Buffer Pool

vm2 before 3.12.2 does not apply its Buffer backing-store ownership invariant byteOffset === 0 and buffer.byteLength === length to Buffers returned from host builtin modules. When an application explicitly exposes Node's zlib module through NodeVM's builtin allowlist require: builtin: 'zlib' ,...

CVE-2026-100723 vm2 before 3.12.2 Memory Disclosure via zlib Buffer Pool

vm2 before 3.12.2 does not apply its Buffer backing-store ownership invariant byteOffset === 0 and buffer.byteLength === length to Buffers returned from host builtin modules. When an application explicitly exposes Node's zlib module through NodeVM's builtin allowlist require: builtin: 'zlib' ,...

CVE-2026-100723

The vm2 library before version 3.12.2 is vulnerable to a memory disclosure and corruption issue due to a failure in applying Buffer backing-store ownership invariants for host builtin modules. When an application exposes the zlib module via NodeVM's builtin allowlist, zlib.deflateSync can return ...

EUVD-2026-87856

vm2 before 3.12.2 does not apply its Buffer backing-store ownership invariant byteOffset === 0 and buffer.byteLength === length to Buffers returned from host builtin modules. When an application explicitly exposes Node's zlib module through NodeVM's builtin allowlist require: builtin: 'zlib' ,...

CVE-2026-100723: Exposure of Sensitive Information to an Unauthorized Actor

vm2 before 3.12.2 does not apply its Buffer backing-store ownership invariant byteOffset === 0 and buffer.byteLength === length to Buffers returned from host builtin modules. When an application explicitly exposes Node's zlib module through NodeVM's builtin allowlist require: builtin: 'zlib' ,...

CVE-2025-14847

mongoExploit CVE-2025-14847 mongoExploit is a Proof-of-Concept PoC exploit tool for CVE-2025-14847 , a memory leak vulnerability in MongoDB. This tool exploits a bug in zlib decompression to leak server memory via BSON field names. By crafting a BSON payload with an inflated document length, it...

CVE-2025-14847

CVE-2025-14847 MongoBleed 📜 Description This script is designed to exploit the heap memory disclosure vulnerability known as CVE-2025-14847 "MongoBleed" in MongoDB Server. By sending specially crafted zlib-compressed OPMSG packets with an inflated document length, the script tricks the server int...

SUSE CVE-2026-67232

RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, The cowboy WebSocket options at line 117 set compress = true, enabling RFC 7692 permessage-deflate negotiation. The handler does not set maxframesize, so cowboy's default of infinity applies...

Linux Distros Unpatched Vulnerability : CVE-2026-67232

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, The cowboy WebSocket options at line 117 set compress...

CVE-2026-67232

RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, The cowboy WebSocket options at line 117 set compress = true, enabling RFC 7692 permessage-deflate negotiation. The handler does not set maxframesize, so cowboy's default of infinity applies...

DEBIAN-CVE-2026-67232

RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, The cowboy WebSocket options at line 117 set compress = true, enabling RFC 7692 permessage-deflate negotiation. The handler does not set maxframesize, so cowboy's default of infinity applies...

CVE-2026-67232

RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, The cowboy WebSocket options at line 117 set compress = true, enabling RFC 7692 permessage-deflate negotiation. The handler does not set maxframesize, so cowboy's default of infinity applies...

UBUNTU-CVE-2026-67232

RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, The cowboy WebSocket options at line 117 set compress = true, enabling RFC 7692 permessage-deflate negotiation. The handler does not set maxframesize, so cowboy's default of infinity applies...

EUVD-2026-85657

RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, The cowboy WebSocket options at line 117 set compress = true, enabling RFC 7692 permessage-deflate negotiation. The handler does not set maxframesize, so cowboy's default of infinity applies...

CVE-2026-67232

RabbitMQ is vulnerable to a decompression bomb attack in the rabbitmq_web_mqtt plugin prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0. The flaw exists because the cowboy WebSocket handler enables permessage-deflate negotiation without setting a max_frame_size, allowing cowlib to call ...