mongobleed

mongobleed CVE-2025-14847 — Эксплойт утечки памяти MongoDB без аутентификации Доказательство концепции эксплуатации уязвимости декомпрессии zlib в MongoDB, позволяющей неаутентифицированным атакующим извлекать конфиденциальные данные из памяти сервера. Уязвимость Ошибка в декомпрессии сообщений...

mongobleed-detector

Детектор MongoBleed Офлайн-инструмент анализа MongoDB для CVE-2025-14847 MongoBleed Автономный инструмент командной строки для Linux, который анализирует данные MongoDB для выявления вероятной эксплуатации уязвимости CVE-2025-14847 с использованием нескольких модулей обнаружения. Оглавление Обзор...

CVE-2026-39113

CVE-2026-39113: SQLite 옵션 SQLAR 확장의 힙 버퍼 오버플로 핵심 요약 CVE-2026-39113은 SQLite의 옵션 SQLAR 확장에서 발생하는 힙 버퍼 오버플로입니다. 확장을 로드한 애플리케이션에서 공격자가 제어된 압축 blob과 크기를 사용해 sqlaruncompress를 호출할 수 있다면, LP64 시스템에서 zlib가 힙 할당 경계를 넘어 쓰기를 수행하게 할 수 있습니다. 이는 호스트 프로세스 내부의 메모리 안전 경계 실패이며, SQLite 데이터베이스 파일 파싱 문제, 인증 우회, 또는 모든 ...

cve-2025-14847

MongoBleed: CVE-2025-14847 メモリリーク発見ツール MongoBleed は、CVE-2025-14847 を検出・実証するために設計された高性能なセキュリティ監査ツールです。この脆弱性により、認証されていないリモート攻撃者が、zlib の展開ロジックにおける長さ不一致の欠陥を悪用して、MongoDB サーバーから未初期化のヒープメモリの断片を漏えいさせることができます。 🛡️ 脆弱性の概要 CVE ID: CVE-2025-14847 ステータス: 実環境で活発に悪用されています（2025年12月下旬時点）。 重大度: 高 CVSS 8.7 影響:...

CVE-2025-14847---MongoBleed

Mongobleed CVE-2025-14847 – Proof of Concept на Go Этот репозиторий содержит proof-of-concept эксплойт на Go для CVE-2025-14847 , уязвимости раскрытия памяти MongoDB, часто называемой Mongobleed. Данный PoC является переписанной на Go версией оригинального эксплойта на Python от Joe Desimone ,...

CVE-2025-14847-MongoBleed

CVE-2025-14847 MongoBleed MongoDB zlib Compression Memory Disclosure — Анализ, обнаружение и устранение Обзор CVE-2025-14847, широко известный как MongoBleed , — это уязвимость раскрытия информации высокой степени серьезности, затрагивающая сервер :contentReferenceoaicite:0index=0. Уязвимость...

mongobleed-exploit-CVE-2025-14847

🩸 MongoBleed - CVE-2025-14847 보안 연구 랩 CVE-2025-14847 | CVSS 8.7 높음 | 인증 없는 메모리 노출 CVE-2025-14847 은 MongoBleed 라고 불리며, MongoDB의 zlib 압축 해제 로직을 악용하여 인증되지 않은 원격 공격자가 초기화되지 않은 힙 메모리를 외부로 유출할 수 있게 합니다. 이 높은 심각도의 결함은 평문 자격 증명 및 세션 토큰을 포함한 민감한 정보를 노출하여, 횡적 이동lateral movement과 완전한 서버 장악을 위한 로드맵을 제공합니다. 📖...

MongoBleed

MongoBleed CVE-2025-14847 Сканер и набор инструментов для эксплуатации Набор инструментов для исследования безопасности MongoBleed — критическая утечка памяти без аутентификации в декомпрессии zlib MongoDB, позволяющая злоумышленникам извлекать конфиденциальные данные из кучи сервера без...

CVE-2025-14847

mongoExploit CVE-2025-14847 mongoExploit 는 CVE-2025-14847 에 대한 개념 증명PoC 익스플로잇 도구로, MongoDB의 메모리 누수 취약점입니다. 이 도구는 zlib 압축 해제의 버그를 이용하여 BSON 필드 이름을 통해 서버 메모리를 유출합니다. 부풀려진 문서 길이를 가진 BSON 페이로드를 조작하여 서버가 null 바이트를 만날 때까지 유출된 메모리에서 필드 이름을 읽도록 강제합니다. ⚠️ 면책 조항 이 도구는 교육 및 승인된 보안 테스트 목적으로만 사용됩니다. 작성자는 이 도구의...

EUVD-2026-67717

CodeChecker's massStoreRun processing path performs one-shot decompression of attacker-controlled, Base64-encoded zlib data without enforcing a maximum decompressed size. An authenticated user with permission to store analysis runs can submit a highly compressed payload that expands to a...

CVE-2026-58107

CodeChecker (Ericsson) is affected by an authenticated remote denial of service in the massStoreRun processing path. The vulnerability arises from one-shot decompression of attacker-controlled, Base64-encoded zlib data without enforcing a maximum decompressed size. An authenticated user with perm...

CVE-2026-58107 Authenticated Remote Denial of Service via Unbounded zlib Decompression in massStoreRun

CodeChecker's massStoreRun processing path performs one-shot decompression of attacker-controlled, Base64-encoded zlib data without enforcing a maximum decompressed size. An authenticated user with permission to store analysis runs can submit a highly compressed payload that expands to a...

CVE-2026-58107 Authenticated Remote Denial of Service via Unbounded zlib Decompression in massStoreRun

CodeChecker's massStoreRun processing path performs one-shot decompression of attacker-controlled, Base64-encoded zlib data without enforcing a maximum decompressed size. An authenticated user with permission to store analysis runs can submit a highly compressed payload that expands to a...

CVE-2025-14847

CVE-2025-14847 – Exploit di perdita di memoria non autenticata di MongoDB Panoramica Un exploit proof‑of‑concept PoC per la vulnerabilità di decompressione zlib di MongoDB che consente a utenti malintenzionati non autenticati di leggere la memoria sensibile del server. Il PoC è implementato in...

Astra Linux – Vulnerability in gst-plugins-good1.0

DOS: Potential heap overwrite during MKV demuxing using Zlib decompression. Integer overflow occurs in the matroskademux element within the gstmatroskadecompressdata function, which can cause a segfault—or potentially a heap overwrite, depending on the libc and operating system. Depending on the...

Astra Linux – Vulnerability in gst-plugins-good1.0

DOS: Potential heap overwrite in qtdemux using zlib decompression. Integer overflow in the qtdemux element within the qtdemuxinflate function can lead to a segfault, or it may cause a heap overwrite, depending on the libc and operating system. Depending on the libc used and the underlying operati...

CVE-2026-77640

A flaw was found in tor. A remote attacker could send a specially crafted, truncated zlib/gzip stream. This could lead to an infinite loop during decompression, causing a denial of service DoS in the affected component. Mitigation Mitigation for this issue is either not available or the currently...

Linux Distros Unpatched Vulnerability : CVE-2026-77640

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - tor before 0.4.9.9 was prone to an infinite loop when decompressing a truncated zlib/gzip stream with done=1. A truncated stream never reaches ZSTREAMEND, causi...

DEBIAN-CVE-2026-77640

tor before 0.4.9.9 was prone to an infinite loop when decompressing a truncated zlib/gzip stream with done=1. A truncated stream never reaches ZSTREAMEND, causing zlib to return ZBUFERROR with no input remaining, which bufaddcompress mistook for a full output buffer and retried forever. Fixed by...

EUVD-2026-63650

tor before 0.4.9.9 was prone to an infinite loop when decompressing a truncated zlib/gzip stream with done=1. A truncated stream never reaches ZSTREAMEND, causing zlib to return ZBUFERROR with no input remaining, which bufaddcompress mistook for a full output buffer and retried forever. Fixed by...