Saint MongoBleed, Who Bled From the Compression

Patron of exposed MongoDB databases, zlib compression, and anyone who leaves port 27017 open to the world.

Life

On 19 December 2025 MongoDB published the advisory for CVE-2025-14847, nicknamed MongoBleed: mismatched length fields in the zlib-compressed protocol headers let an unauthenticated client read uninitialised heap memory, logs, internal paths and client addresses. A public exploit appeared soon after, attacks began quickly, and by late December CISA added the flaw to its catalogue of exploited vulnerabilities.

Prayer

O Saint MongoBleed, who bleeds memory from a compressed header, let our databases speak to no strangers. Amen.

How to celebrate

Celebrated by updating MongoDB to the fixed versions, disabling zlib compression in the meantime, and closing 27017 to the internet.

Exposed database, uncovered memory.