MongoDB Security issue CVE-2025-14847 aka MongoBleed

[Paul_Holden]

Hi,

Can someone comment on the exposure, and available remediations (if required), for the embedded MongoDB with reference to CVE-2025-14847, commonly referred to as MongoBleed?

My understanding is that this potentially impacts all versions of MongoDB currently supplied with supported versions of Alteryx server?

Does the Alteryx implementation use zlib compression?

If so is it possible to switch it off?

If it is required what are the plans to patch the various supported versions of server?

[fmvizcaino · Accepted solution]

Hi @Paul_Holden ,

I reached out to Alteryx about this last week and they released a KB with a quick fix.

https://knowledge.alteryx.com/index/s/article/MongoDB-zlib-Compression-Vulnerability-CVE-2025-14847-...

They also mentioned that they will release a formal patch soon.

Best,

Fernando

[Paul_Holden]

Brilliant, thanks for the pointer.

[TheCoffeeDude]

It should be noted that if you're running a user-managed MongoDB instance, you should upgrade/patch to a new version or follow the mitigation in the knowledge article that Fernando provided. The CVE-2025-14847 report provides information on which versions are not vulnerable. Additionally, MongoDB Atlas has already been patched to the latest non-vulnerable version (if you have that feature turned on).