MongoBleed Detector Tool Released to Detect MongoDB Vulnerability(CVE-2025-14847)
An open-source detection tool has been released to assist organizations in identifying potential exploitation of the MongoBleed vulnerability ( CVE-2025-14847 ), a critical memory disclosure issue affecting MongoDB databases.
An open-source detection tool has been released to assist organizations in identifying potential exploitation of the MongoBleed vulnerability ( CVE-2025-14847 ), a critical memory disclosure issue affecting MongoDB databases.
This vulnerability allows attackers to extract sensitive information, such as credentials and session tokens, directly from server memory without authentication.
The flaw is present in MongoDB's zlib decompression mechanism and affects versions from 4.4 to 8.2.2.
The MongoBleed Detector is an offline, command-line tool that examines MongoDB JSON logs to detect exploitation attempts. It does not require network connectivity or additional agents, making it suitable for forensic analysis and incident response.
The detection mechanism correlates three MongoDB log event types: connection accepted (22943), client metadata (51800), and connection closed (22944).
Legitimate MongoDB drivers send metadata immediately after connecting. The MongoBleed exploit connects, extracts memory, and disconnects without sending metadata.
The tool identifies suspicious patterns characterized by high connection volumes from a single IP address, the absence of client metadata , and short-duration burst behavior exceeding 100,000 connections per minute.
The flaw is present in MongoDB's zlib decompression mechanism and affects versions from 4.4 to 8.2.2.
Log Analysis: Supports compressed logs; compatible with IPv4 and IPv6. Risk Levels: Four severity ratings: HIGH, MEDIUM, LOW, INFO. Detection Controls: Configurable detection thresholds. Forensics Mode: Analyzes evidence from multiple hosts. Remote Scanning: SSH-based Python wrapper for scanning multiple MongoDB instances. Action Required: Patch vulnerable MongoDB versions and scan for compromise.
The detector supports compressed log processing, handles both IPv4 and IPv6 addresses, and provides risk classification across four severity levels: HIGH, MEDIUM, LOW, and INFO. It offers configurable detection thresholds and includes a forensic folder mode for analyzing evidence collected from multiple hosts.
The tool also includes a Python wrapper for remote execution via SSH, enabling security teams to scan multiple MongoDB instances simultaneously.
MongoDB Major Version Affected Versions Recommended Fixed Version
4.4 4.4.0 – 4.4.29 4.4.30 or later
5.0 5.0.0 – 5.0.31 5.0.32 or later
6.0 6.0.0 – 6.0.26 6.0.27 or later
7.0 7.0.0 – 7.0.27 7.0.28 or later
8.0 8.0.0 – 8.0.16 8.0.17 or later
8.2 8.2.0 – 8.2.2 8.2.3 or later
According to an advisory on GitHub , organizations using vulnerable MongoDB versions should apply available patches immediately and use the detector to investigate potential compromise.
Based on reporting by Cyber Security News.