What is the CVSS score of CVE-2025-61301?

CVE-2025-61301 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.4%.

Which versions of CAPEv2 are affected by CVE-2025-61301?

CAPEv2, a widely deployed open-source malware analysis platform, contains a denial-of-service flaw allowing attackers who can submit samples to disable behavioral report generation.

How to fix or mitigate CVE-2025-61301?

Within 24 hours: Confirm production deployment of CAPEv2 and identify services consuming behavioral reports. Within 7 days: Enforce access controls restricting sample submission to authenticated internal analysts only; enable monitoring and alerting for failed report generation and malformed BSON/JSON errors in the reporting pipeline; audit recent reports for truncation or missing data. Within 30 days: Monitor CAPEv2 project for vendor-released patches; evaluate network segmentation or deployment in isolated environments; test input validation and size-limit enforcement mechanisms.

CAPEv2 CVE-2025-61301

HIGH

Uncontrolled Resource Consumption (CWE-400)

2025-10-20 cve@mitre.org

Denial Of Service

7.5

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Primary rating from Vendor (mitre) · only source for this CVE.

CVSS VectorVendor: mitre

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 05, 2026 - 03:01 vuln.today

DescriptionCVE.org

Denial-of-analysis in reporting/mongodb.py and reporting/jsondump.py in CAPEv2 (commit 52e4b43, on 2025-05-17) allows attackers who can submit samples to cause incomplete or missing behavioral analysis reports by generating deeply nested or oversized behavior data that trigger MongoDB BSON limits or orjson recursion errors when the sample executes in the sandbox.

AnalysisAI

Denial-of-analysis in CAPEv2, the open-source malware analysis sandbox, lets anyone able to submit a sample sabotage the platform's own reporting pipeline. A crafted sample that emits deeply nested or oversized behavior data trips MongoDB BSON size limits or orjson recursion errors in reporting/mongodb.py and reporting/jsondump.py, causing the behavioral report to be truncated or dropped entirely. Rated CVSS 7.5 (availability-only); EPSS is modest at 0.39% (31st percentile) and there is no public exploit identified at time of analysis, though the vector is trivial for anyone who can run a sample.