MONGODB UNAUTHENTICATED ATTACKER SENSITIVE MEMORY LEAK

Summary from the TLDR InfoSec newsletter

A critical flaw in MongoDB's use of the zlib compression library allows network attackers to leak sensitive data from server memory without requiring authentication. By sending specially crafted compressed messages, they can gradually extract user information, passwords, and API keys from affected MongoDB versions. Updating to patched releases, closing unnecessary ports, and disabling zlib compression where possible are key steps to reduce exposure.