Loading story…
Security advisories warned of two severe database software vulnerabilities with immediate internet-facing risk. In MongoDB, an unauthenticated network attacker can trigger an information disclosure flaw—described in some reporting as MongoBleed—to make a vulnerable server return sensitive data such as credentials, secrets, and personal information. The issue affects MongoDB releases dating back to about 2017 and stems from insufficient validation in the zlib implementation, which can leak uninitialized heap memory allocated to MongoDB. Working exploitation methods are known, and defenders were told to watch for large volumes of malformed or compressed requests, decompression or memory-handling errors, and repeated unauthenticated connections. Patches are available in versions 8.2.3, 8.0.17, 7.0.28, 6.0.27, 5.0.32, and 4.4.30, while end-of-life branches remain unpatched.
A separate advisory disclosed a critical Redis vulnerability affecting 8.2.1 and earlier when Lua scripting is enabled, which is the default configuration. The flaw is a use-after-free condition that can be triggered by a specially crafted Lua script and may allow remote arbitrary code execution, giving an attacker full control of the host running Redis. Officials urged immediate upgrades because the vulnerability is publicly known and exploitation could begin within hours, and they advised organizations to inspect any previously exposed Redis environments for signs of compromise. Fixed versions were listed as 6.2.20, 7.2.11, 7.4.6, 8.0.4, and 8.2.2, alongside renewed guidance that Redis instances should not be exposed directly to the public internet.
See affected versions and whether adversaries are exploiting it.
4 events from the most recent confirmed update back to the earliest known activity.
Redis published fixed versions 6.2.20, 7.2.11, 7.4.6, 8.0.4, and 8.2.2 for the Lua scripting vulnerability. Guidance also reiterated that Redis instances should not be exposed directly to the public internet and that previously exposed systems should be checked for compromise.
A critical use-after-free vulnerability in Redis affecting version 8.2.1 and earlier was disclosed, impacting deployments with Lua scripting enabled by default. The flaw can potentially allow remote arbitrary code execution over the network, and defenders were warned that exploitation could begin within hours.
MongoDB released patched versions 8.2.3, 8.0.17, 7.0.28, 6.0.27, 5.0.32, and 4.4.30 to address the information disclosure flaw, while end-of-life versions remain without fixes. Finland's NCSC published an alert describing exploitation indicators such as malformed or zlib-compressed requests and repeated unauthenticated connections.
A MongoDB vulnerability caused by insufficient validation in zlib can let an unauthenticated network attacker retrieve sensitive data such as credentials, secrets, and personal data from vulnerable servers. The issue affects all MongoDB versions released since approximately 2017, with working exploitation methods reported.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
4 references tracked. Mallory keeps watching after this page renders.
kyberturvallisuuskeskus.fi
Open sourcekyberturvallisuuskeskus.fi
Open sourcekyberturvallisuuskeskus.fi
Open sourcekyberturvallisuuskeskus.fi
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Redis disclosed five vulnerabilities affecting Redis Cloud, Redis Software, and Redis OSS/CE that could allow authenticated attackers to achieve **remote code execution**, system compromise, data exfiltration, or service disruption. The issues tracked as `CVE-2026-23479`, `CVE-2026-25243`, `CVE-2026-25588`, `CVE-2026-25589`, and `CVE-2026-23631` include an invalid memory access flaw in the `RESTORE` command, a use-after-free bug in the unblock client flow, and a Lua use-after-free condition in certain replica configurations. Public advisories and downstream alerts described four of the bugs as high severity and one as medium severity, with multiple flaws capable of leading to arbitrary code execution. Redis said **Redis Cloud** deployments had already been patched and required no customer action, while self-managed users were told to upgrade to fixed releases across Redis OSS/CE, Redis Software, RedisTimeSeries, and RedisBloom. Government and national CERT notices echoed the vendor guidance and urged administrators to review the advisories and apply updates promptly. Redis also said it had **no evidence of active exploitation** at publication time, but recommended immediate patching and hardening measures such as restricting network exposure, enforcing strong authentication, keeping protected mode enabled where appropriate, and applying least-privilege access controls.
Jun 29, 2026
A critical security vulnerability, tracked as CVE-2025-49844, has been identified in Redis, an open-source, in-memory database widely used for caching and data storage. The flaw is rated with a CVSS score of 10.0, indicating maximum severity and potential for significant impact. This vulnerability arises from a use-after-free condition in the Lua scripting engine of Redis, which can be exploited by an authenticated user. By crafting a malicious Lua script, an attacker can manipulate the garbage collector within Redis, triggering the use-after-free bug. Successful exploitation of this flaw allows remote code execution on the affected Redis server, granting attackers the ability to run arbitrary code with the privileges of the Redis process. All Redis versions up to and including 8.2.1 are affected by this vulnerability, as they include the vulnerable Lua scripting functionality. The issue has been addressed in Redis version 8.2.2, which contains the necessary patch to remediate the flaw. As an immediate mitigation for organizations unable to upgrade, Redis administrators are advised to restrict the execution of Lua scripts by disabling the EVAL and EVALSHA commands through Access Control Lists (ACLs). The vulnerability requires authentication, but in environments where Redis is exposed to untrusted users or where credentials are weak, the risk of exploitation is heightened. Security advisories recommend prompt patching and review of user permissions to minimize exposure. The flaw was publicly disclosed in early October 2025, and security researchers have emphasized the critical nature of the bug due to its potential for remote exploitation. No specific products beyond Redis itself have been listed as affected, but any deployment using vulnerable versions is at risk. The vulnerability has been confirmed to be remotely exploitable, making it a high-priority issue for organizations relying on Redis for critical infrastructure. The security community has highlighted the importance of monitoring for suspicious Lua script activity as an additional detection measure. Redis users are urged to consult official advisories and update their systems as soon as possible to prevent compromise. The disclosure underscores the ongoing risks associated with embedded scripting engines in widely deployed software. Organizations should also review their network exposure and ensure Redis instances are not accessible from untrusted networks. The incident serves as a reminder of the importance of timely patch management and the need for defense-in-depth strategies in database deployments.
Jul 23, 2026
MongoDB patched a high-severity information disclosure vulnerability, **CVE-2025-14847** or **MongoBleed**, that allows a remote unauthenticated attacker to read sensitive heap memory from vulnerable servers. The flaw affects `OP_COMPRESSED` messages using `zlib`: by manipulating the BSON `uncompressedSize` field, an attacker can make MongoDB allocate an oversized buffer without validating the claimed length, which can cause the server to return uninitialized memory. Researchers said the leak can expose cleartext passwords, credentials, API keys, and other secrets, and can be amplified when a malformed BSON object omits a null terminator, causing MongoDB to continue parsing memory until a null byte is found and include leaked contents in an error response. The vulnerability has been reported as **actively exploited**, and public proof-of-concept code is available. Affected releases include MongoDB Server 8.2 before 8.2.3, 8.0 before 8.0.17, 7.0 before 7.0.28, 6.0 before 6.0.27, 5.0 before 5.0.32, 4.4 before 4.4.30, and all versions of 4.2, 4.0, and 3.6. Defenders were urged to upgrade immediately, disable `zlib` request compression until patching is complete, restrict Internet exposure of TCP port `27017`, review logs for exploitation attempts, and rotate passwords and cryptographic material that may have been exposed. Researchers also warned that internet-scale exposure could be significant, citing tens of thousands to more than 200,000 internet-accessible MongoDB instances identified by scanning services.
Jul 24, 2026