PT-2025-42814 · Orjson+2 · Orjson+2

Published 2025-10-20 · Updated 2025-10-21 · CVE-2025-61301

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions CAPEv2 versions prior to commit 52e4b43 on 2025-05-17

Description The software contains a flaw that allows attackers who can submit samples to cause incomplete or missing behavioral analysis reports. This occurs by generating deeply nested or oversized behavior data that triggers MongoDB BSON limits or orjson recursion errors when a sample executes within the sandbox environment. The issue affects the reporting/mongodb.py and reporting/jsondump.py components.

Recommendations Update to CAPEv2 commit 52e4b43 or a later version.

Exploit

Fix

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

CVE-2025-61301

Affected Products

Capev2

Mongodb

Orjson

References · 8

• 🔥 https://github.com/eGkritsis/CVE-2025-61301 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-61301 · Security Note
• https://github.com/kevoreilly/CAPEv2 · Note
• https://twitter.com/CVEnew/status/1980376523786871100 · Twitter Post
• https://t.me/cveNotify/139534 · Telegram Post
• https://t.me/cveNotify/139596 · Telegram Post
• http://capev2.com · Note
• https://t.me/CVEtracker/35353 · Telegram Post