Security readout for executives and security teams
Plain-English summary
CAPEv2 can fail to produce complete malware-analysis reports when an attacker submits a sample that generates excessively large or deeply nested behavior data. The weakness disrupts analysis availability rather than exposing or altering stored information, potentially creating blind spots for security teams relying on sandbox results.
Executive priority
Prioritize remediation for internet-accessible or broadly shared malware-analysis services because attackers could suppress analysis results and create investigation blind spots. Treat this as an availability and detection-integrity issue, not evidence of data theft. Restrict submissions and increase report-failure monitoring while the responsible team confirms an official fix.
Technical view
CVE-2025-61301 is a CWE-400 resource-handling weakness in CAPEv2 reporting/mongodb.py and reporting/jsondump.py. Executed samples can generate behavior data that exceeds MongoDB BSON limits or orjson recursion limits, causing incomplete or missing reports. The supplied CVSS 3.1 score is 7.5, with network-accessible, low-complexity, unauthenticated impact characterized as availability-only.
Likely exposure
Exposure is most plausible where CAPEv2 accepts samples from untrusted or unauthenticated network users and uses the affected reporting paths. The source bundle identifies commit 52e4b43 but provides no reliable affected-version range, deployment prevalence, or configuration prerequisites. Each deployment therefore requires revision and reporting-configuration review.
Exploitation context
The described attack requires submitting a sample whose sandbox behavior produces oversized or deeply nested report data. CISA KEV status is false, and the supplied sources provide no evidence of active exploitation. Public technical research is referenced, but exploitation prevalence and operational reliability are not established in the bundle.
Researcher notes
The record names two reporting modules and two failure boundaries, but does not provide affected releases, a fixed version, or an official mitigation. Commit 52e4b43 is referenced as the observed code state, not necessarily a complete version boundary. Validate conclusions against CAPEv2 history and vendor guidance before declaring individual systems vulnerable or remediated.
Mitigation direction
- Check current CAPEv2 vendor guidance and repository history for an official correction or safe release.
- Restrict sample submission to authenticated, trusted users until exposure is resolved.
- Apply submission quotas and resource controls as interim safeguards where operationally appropriate.
- Monitor for missing reports, BSON-size failures, recursion errors, and repeated suspicious submissions.
Validation and detection
- Identify the deployed CAPEv2 revision and compare it with current vendor guidance.
- Confirm whether MongoDB and JSON dump reporting modules are enabled.
- Review reporting logs for BSON limit, recursion, serialization, or incomplete-report errors.
- Verify every completed sandbox execution produces expected reports across configured reporting backends.
- Test any vendor-provided correction in an isolated environment using safe boundary-condition data.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-400: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2025-61301 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.5 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H3.93.6CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
7.5HighVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/kevoreilly/CAPEv2CVE reference, mitre
- https://github.com/eGkritsis/CVE-2025-61301CVE reference, mitre
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Uncontrolled Resource Consumption
Uncontrolled Resource Consumption represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.