Threat Management, Threat Intelligence, Critical Infrastructure Security, Government security

Active MongoBleed exploitation warned by US, Australia

The Cybersecurity and Infrastructure Security Agency (CISA) emblem is seen at its headquarters in Arlington, Va.

Ongoing intrusions involving the critical MongoDB and MongoDB Server vulnerability dubbed "MongoBleed" have prompted separate alerts from the U.S. Cybersecurity and Infrastructure Security Agency and the Australian Signals Directorate, SiliconANGLE reports.

All federal civilian executive branch agencies should remediate the improper length parameter inconsistency management flaw, tracked as CVE-2025-14847, by Jan. 19, according to CISA.

On the other hand, the ASD noted global exploitation of the security issue, which originates from MongoDB Server's management of zlib library-processed network packets for lossless data compression. Both warnings come as nearly 87,000 MongoDB instances were discovered to be at risk of being compromised via MongoBleed.

"Similar to other heap disclosure vulnerabilities such as Heartbleed, the impact of exploitation will vary depending on the information an attacker is able to obtain from the heap. However, it is quite likely that the leaked memory will contain credentials or other sensitive information, especially as attackers learn more about the vulnerability and use it more effectively," said Intruder Systems Head of Security Dan Andrew.

Get daily email updates

SC Media's daily must-read of the most current and pressing daily news

By clicking the Subscribe button below, you agree to SC Media Terms of Use and Privacy Policy.

You can skip this ad in 5 seconds