- 29th December 2025
A compression bug in MongoDB turns a core database feature into a silent data exfiltration channel. CVE-2025-14847, nicknamed MongoBleed, allows remote attackers to extract uninitialized heap memory without credentials. With zlib enabled by default and tens of thousands of instances exposed online, this is a real-world data breach waiting to happen.
Francesco Cipollone