Jan 1, 2026·5 min read·70 visits
Dubbed 'MongoBleed', this vulnerability mimics the infamous Heartbleed bug. By sending a crafted compressed packet, an unauthenticated attacker can trick the server into treating uninitialized heap memory as valid data. When the parser inevitably chokes on the garbage data, it helpfully echoes it back in an error message, leaking sensitive secrets like admin credentials and session tokens.
A critical, unauthenticated heap memory disclosure vulnerability in MongoDB's wire protocol handling allows attackers to bleed secrets—including passwords and AWS keys—directly from server memory.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N| Product | Affected Versions | Fixed Version |
|---|---|---|
MongoDB Server MongoDB Inc. | 8.2.0 - 8.2.2 | 8.2.3 |
MongoDB Server MongoDB Inc. | 8.0.0 - 8.0.16 | 8.0.17 |
MongoDB Server MongoDB Inc. | 7.0.0 - 7.0.27 | 7.0.28 |
MongoDB Server MongoDB Inc. | 6.0.0 - 6.0.26 | 6.0.27 |
MongoDB Server MongoDB Inc. | 5.0.0 - 5.0.31 | 5.0.32 |
MongoDB Server MongoDB Inc. | 4.4.0 - 4.4.29 | 4.4.30 |
MongoDB Server MongoDB Inc. | 3.6, 4.0, 4.2 | None (EOL) |
| Attribute | Detail |
|---|---|
| CWE ID | CWE-200 (Exposure of Sensitive Information) |
| CVSS v4.0 | 8.7 (High) |
| Attack Vector | Network (Unauthenticated) |
| EPSS Score | 77.17% |
| Exploit Status | Active / Weaponized |
| Component | message_compressor_zlib.cpp |
| Protocol | OP_COMPRESSED (2012) |
The product exposes sensitive information to an unauthorized actor by sending it back in an error message or other response.
An uncontrolled resource consumption vulnerability exists in the Scala-based http4s-blaze-server package of the http4s/blaze library. The vulnerability allows remote, unauthenticated attackers to cause an Out of Memory Error (OOM) and JVM crash by streaming a continuous sequence of small or empty WebSocket continuation frames with the FIN bit set to 0. This bypasses typical payload size checks because of the JVM's per-object allocation overhead, leading to rapid heap exhaustion with minimal network bandwidth.
A critical path traversal vulnerability has been identified in the OpenList Go-based backend package. The vulnerability exists within the batch rename handler because the application does not validate the source filename parameter before constructing filesystems paths. This omission allows authenticated users to escape their designated directory and rename files in sibling paths.
OpenList version 4.2.3 and prior is vulnerable to an authorization bypass and metadata leakage. When configured with the Bleve search engine backend, OpenList fails to perform separator-aware path matching when validating tenant containment. This allows authenticated users to access sibling directories sharing similar name prefixes. Furthermore, the search backend returns unfiltered global result counts, leaking existence verification data of unauthorized files via side-channel analysis.
An authorization bypass vulnerability in OpenList version 4.2.3 and below allows authenticated users to read arbitrary files outside of their designated base directories due to an insecure path prefix check using Go's standard strings.HasPrefix function.
A security policy bypass vulnerability exists in the AWS API MCP Server (awslabs-aws-api-mcp-server) from version 0.2.13 through 1.3.46. When the server fails to load the read-only operations index during startup (due to transient network failures, file permission issues, or other exceptions), it logs a warning but continues running in an insecure, degraded state. Under this condition, the security policy engine fails open, silently skipping all subsequent security checks and consent prompts for the lifetime of the process. This permits unauthorized mutating AWS CLI commands to execute via indirect prompt injection attacks.
An incomplete escaping vulnerability in the npm package 'shescape' allows unauthenticated users to trigger dynamic shell expansions, absolute path disclosure, and command block break-outs on Unix and Windows systems.