CVE-2025-14847 — MongoBleed

CVE-2025-14847, also known as MongoBleed, is a vulnerability that allows attackers to read unauthorised data from the heap memory of the server running MongoDB — without any authentication.

MongoDB is a document-oriented, open-source NoSQL database. It stores data in formats such as JSON, BSON and XML, and supports search, delete and update operations over that data.

Background

MongoDB uses a socket-based protocol called the MongoDB Wire Protocol between client and server. After a connection is established, communication happens by sending and receiving OP_MSG message packets. For performant transfer of large payloads, MongoDB uses the OP_COMPRESSED packet format.

The parameter that matters is uncompressedSize — “the size the compressed data sent from client to server will occupy in memory once it is decompressed on the server.”

Root cause

// line 72 — client value assigned to length
length = uncompressedSize;

// line 73 — uncompress computes the real size into length
uncompress(output.data(), &length, input.data(), input.size());

// line 83 — ROOT CAUSE
// length was updated, but output.length() still returns the client's size!
return SharedBuffer::allocate(output.length());

Inside decompressData, memory is allocated according to the client-supplied uncompressedSize. Data is read from the server's heap in the size the client chose, and returned to the client as if it were the result of decompression. The leaked memory can contain usernames, passwords, tokens and system configuration data.

The BSON leak

Objects in MongoDB are serialised/deserialised to the client in BSON (Binary JSON). During parsing, the end of a value is detected by a \0 null terminator. When the client-supplied BSON does not end with \0, Mongo keeps scanning the allocated region for one. Since no valid BSON object forms, an error is thrown — and that error message leaks memory contents.

The fix

The vulnerability was resolved by using the real length of the decompressed data during the decompressData operation, rather than the client-supplied value.