BaseFortify

Publication date: 2025-10-20

Last updated on: 2026-07-05

Assigner: MITRE

Description

Denial-of-analysis in reporting/mongodb.py and reporting/jsondump.py in CAPEv2 (commit 52e4b43, on 2025-05-17) allows attackers who can submit samples to cause incomplete or missing behavioral analysis reports by generating deeply nested or oversized behavior data that trigger MongoDB BSON limits or orjson recursion errors when the sample executes in the sandbox.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2025-10-20

Last Modified

2026-07-05

Generated

2026-07-06

AI Q&A

2025-10-21

EPSS Evaluated

2026-07-05

NVD

CVE-2025-61301

Affected Vendors & Products

Vendor	Product	Version / Range
cape	capev2	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-400	The product does not properly control the allocation and maintenance of a limited resource.

Attack-Flow Graph

Executive Summary

This vulnerability is a denial-of-analysis issue in CAPEv2's reporting modules (reporting/mongodb.py and reporting/jsondump.py). Attackers who can submit samples can cause the behavioral analysis reports to be incomplete or missing by submitting samples that generate deeply nested or oversized behavior data. This triggers MongoDB BSON limits or orjson recursion errors during sandbox execution, preventing proper analysis reporting.

Impact Analysis

The vulnerability can impact you by causing incomplete or missing behavioral analysis reports when running samples in the CAPEv2 sandbox. This means that malicious behavior might not be fully captured or reported, reducing the effectiveness of malware analysis and potentially allowing threats to go undetected.

Hi! I’m here to help you understand CVE-2025-61301. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70