CVE-2025-14847 Zlib compressed protocol header length confusion may allow memory read

Mismatched length fields in Zlib compressed protocol headers may allow a read of uninitialized heap memory by an unauthenticated client. This issue affects all MongoDB Server v7.0 prior to 7.0.28 versions, MongoDB Server v8.0 versions prior to 8.0.17, MongoDB Server v8.2 versions prior to 8.2.3,...

EUVD-2025-204529

Mismatched length fields in Zlib compressed protocol headers may allow a read of uninitialized heap memory by an unauthenticated client. This issue affects all MongoDB Server v7.0 prior to 7.0.28 versions, MongoDB Server v8.0 versions prior to 8.0.17, MongoDB Server v8.2 versions prior to 8.2.3,...

MongoDB Server 安全漏洞

MongoDB Server is a set of open source NoSQL databases from the American company MongoDB. The database provides collection-oriented storage, dynamic querying, data replication and automatic failover. A security vulnerability exists in MongoDB Server, which stems from a Zlib compression protocol...

PT-2025-52440

Name of the Vulnerable Software and Affected Versions MongoDB Server versions prior to 8.2.3 MongoDB Server versions prior to 8.0.17 MongoDB Server versions prior to 7.0.28 MongoDB Server versions prior to 6.0.27 MongoDB Server versions prior to 5.0.32 MongoDB Server versions prior to 4.4.30...

ROS-20251219-7305

Vulnerability in mongodb-org related to incorrect input of configuration data. The vulnerability can be exploited remotely...

ROS-20251219-7303

A vulnerability in the MongoDB database management system server is related to the use of assert or a similar operator. Exploitation of the vulnerability could allow a remote attacker to affect the availability of protected information...

ROS-20251219-7304

Vulnerability in mongodb-org related to flaws in authorization procedure. Exploitation of the vulnerability may allow a remote attacker to gain unauthorized access to protected information...

MongoDB Memory Disclosure (CVE-2025-14847) - Mongobleed

This module exploits a memory disclosure vulnerability in MongoDB's zlib decompression handling CVE-2025-14847. By sending crafted OPCOMPRESSED messages with inflated BSON document lengths, the server reads beyond the decompressed buffer and returns leaked memory contents in error messages. The...

MongoDB -- Improper Handling of Length Parameter Inconsistency

https://jira.mongodb.org/browse/SERVER-115508 reports: Mismatched length fields in Zlib compressed protocol headers may allow a read of uninitialized heap memory by an unauthenticated client...

rockmongo 安全漏洞

rockmongo is a MongoDB management tool for Chaos Personal Developers. A security vulnerability exists in RockMongo version 1.1.7, which stems from a stored cross-site scripting vulnerability that could lead to the execution of arbitrary JavaScript...

CVE-2025-14345

A post-authentication flaw in the network two-phase commit protocol used for cross-shard transactions in MongoDB Server may lead to logical data inconsistencies under specific conditions which are not predictable and exist for a very short period of time. This error can cause the transaction...

16TB of MongoDB Database Exposes 4.3 Billion Lead Gen Records

Cybersecurity researchers discovered an unsecured 16TB database exposing 4.3 billion professional records, including names, emails, and LinkedIn data. Learn what happened, why this massive data leak enables new scams, and how to protect your PII...

ROS-20251215-7301

Vulnerability in mongodb-org related to incorrect resource locking. Exploitation of the vulnerability could allow an attacker to cause a denial of service...

Out-of-Bounds Read

mongodb/mongodb-extension is vulnerable to Out-of-Bounds Read. The vulnerability is due to improper handling of large options in mongocbulkoperationt, which allows an attacker to trigger invalid memory reads and potentially cause a crash or information disclosure...

BIT-MONGODB-2025-13643 MongoDB Server may allow queries to be terminated by unauthorized users

A user with access to the cluster with a limited set of privilege actions may be able to terminate queries that are being executed by other users. This may cause a denial of service by preventing a fraction of queries from successfully completing. This issue affects MongoDB Server v7.0 versions...

Linux Distros Unpatched Vulnerability : CVE-2025-14345

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A post-authentication flaw in the network two-phase commit protocol used for cross-shard transactions in MongoDB Server may lead to logical data inconsistencies...

Exploit for Code Injection in Mongoosejs Mongoose

CVE-2025-23061 - Mongoose Command Injection A proof of concep...

FreeBSD : MongoDB Server -- Improper Locking (c11e0878-d6a8-11f0-8e1b-b42e991fc52e)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the c11e0878-d6a8-11f0-8e1b-b42e991fc52e advisory. https://jira.mongodb.org/browse/SERVER-106075 reports: A post-authenticationflaw in the network two-pha...

Security Bulletin: IBM® Db2® is affected by a vulnerability in the mongo library (CVE-2025-0755)

Summary IBM® Db2® is affected by a vulnerability in MongoDB C driver library and may be susceptible to buffer overflow when performing operations that could result in a final BSON document which exceeds the maximum allowable size INT32MAX, resulting in a segmentation fault and possible applicatio...

EUVD-2025-201945

A post-authentication flaw in the network two-phase commit protocol used for cross-shard transactions in MongoDB Server may lead to logical data inconsistencies under specific conditions which are not predictable and exist for a very short period of time. This error can cause the transaction...