MongoDB Server Heap Memory Disclosure Vulnerability via Zlib Compression in Protocol Headers

A vulnerability exists in MongoDB Server in the zlib compressed protocol headers, where mismatched length fields may lead to an unauthorized read of uninitialized heap memory. This issue affects multiple MongoDB Server versions across the 3.6 to 8.2 release series. The vulnerability arises from the server's handling of compressed messages, allowing a client to exploit the protocol and access sensitive memory areas without authentication.

Impact

Exploitation of this vulnerability can result in the unauthorized disclosure of uninitialized heap memory, which may contain sensitive information or lead to further exploitation.

Remediation

Users are advised to upgrade to MongoDB versions 8.2.3, 8.0.17, 7.0.28, 6.0.27, 5.0.32, or 4.4.30. If an immediate upgrade is not possible, zlib compression can be disabled by starting the MongoDB server with a networkMessageCompressors or net.compression.compressors option that omits zlib, using alternatives like snappy, zstd, or disabling compression altogether.