This vulnerability exists in CAPEv2's reporting/mongodb.py and reporting/jsondump.py modules as of commit 52e4b43 dated 2025-05-17. It allows an attacker who can submit samples to the sandbox to cause denial-of-analysis by generating behavior data that is deeply nested or oversized. Such data triggers MongoDB BSON size limits or recursion errors in the orjson library, leading to incomplete or missing behavioral analysis reports. The CVSS v3.1 score is 7.5 (High) with vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, indicating a network attack vector with no privileges or user interaction required, causing high impact on availability but no confidentiality or integrity impact.

The impact is denial of availability of behavioral analysis reports generated by CAPEv2. Attackers can cause the analysis system to fail to produce complete or any reports by exploiting BSON size limits or JSON recursion errors. There is no direct impact on confidentiality or integrity of data, but the availability of analysis results is significantly affected.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor vendor communications for updates. Until a fix is available, consider limiting sample submission sizes or implementing input validation to prevent deeply nested or oversized behavior data from triggering these errors.