42 points | by plorkyeran 3 hours ago ago
11 comments
Why did it take them 4 days between publishing a CVE for the vulnerability (Dec 19th) and posting a public patch (Dec 23rd)?
Had their hands full getting sued the same day: https://news.ycombinator.com/item?id=46403128
In the US, the last two weeks of December can be slow due to the holiday season. I wouldn’t be surprised if Mongo wasn’t as staffed as usual.
That's a good question. I suppose that posting the commit makes it incredibly obvious how to exploit the issue, so maybe they wanted to wait a little bit longer for their on-prem users who were slow to patch?
Posting the CVE and then the patch is the reverse of this.
By "patch" I am talking about the public commit. Updated binaries were made available when the CVE was published.
Gemini generated explanation and simulation of MongoBleed: https://gemini.google.com/share/3529c5bb7d38
Reference: https://bigdata.2minutestreaming.com/p/mongobleed-explained-...
1 day ago, 116 comments: https://news.ycombinator.com/item?id=46414475
if you are using mongodb in 2026 you deserve everything headed in your direction
Who has mongo open to the internet?
Ubisoft does
Why did it take them 4 days between publishing a CVE for the vulnerability (Dec 19th) and posting a public patch (Dec 23rd)?
Had their hands full getting sued the same day: https://news.ycombinator.com/item?id=46403128
In the US, the last two weeks of December can be slow due to the holiday season. I wouldn’t be surprised if Mongo wasn’t as staffed as usual.
That's a good question. I suppose that posting the commit makes it incredibly obvious how to exploit the issue, so maybe they wanted to wait a little bit longer for their on-prem users who were slow to patch?
Posting the CVE and then the patch is the reverse of this.
By "patch" I am talking about the public commit. Updated binaries were made available when the CVE was published.
Gemini generated explanation and simulation of MongoBleed: https://gemini.google.com/share/3529c5bb7d38
Reference: https://bigdata.2minutestreaming.com/p/mongobleed-explained-...
1 day ago, 116 comments: https://news.ycombinator.com/item?id=46414475
if you are using mongodb in 2026 you deserve everything headed in your direction
Who has mongo open to the internet?
Ubisoft does