CVE-2025-61301

HighCVSS 7.5

Published: 20/10/2025(UTC)Updated: 05/07/2026(UTC)Translated: 06/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.32%

24th percentile - higher than 24% of all known CVEs

Summary

A vulnerability in CAPEv2 (commit 52e4b43) in reporting/mongodb.py and reporting/jsondump.py allows attackers to submit samples that generate deeply nested or oversized behavioral data, triggering MongoDB BSON limits or orjson recursion errors. This results in incomplete or missing behavioral analysis reports.

Risk Assessment

The organization may receive incomplete or false-negative malware analysis reports, leading to incorrect security decisions and potential oversight of actual threats.

Recommendation

Update CAPEv2 to a patched version or enforce limits on the depth and size of behavioral data before writing to MongoDB and JSON.

Other vulnerabilities in CAPEv2

CVE-2026-90768High
CAPEv2 through commit 471ee4b fails to validate task ownership in REST API endpoints, allowing authenticated users to read and delete analyses submitted by other users. Attackers can enumerate all tasks in the system and delete arbitrary analyses by sending requests to task view and delete endpoints without ownership verification.

Original NVD description (English source)

Denial-of-analysis in reporting/mongodb.py and reporting/jsondump.py in CAPEv2 (commit 52e4b43, on 2025-05-17) allows attackers who can submit samples to cause incomplete or missing behavioral analysis reports by generating deeply nested or oversized behavior data that trigger MongoDB BSON limits or orjson recursion errors when the sample executes in the sandbox.