Skip to content
OpenAdvisories
High · 7.5 CVE-2026-32933 EUVD-2026-13505GHSA-rvv3-g6hj-g44x

AutoMapper Vulnerable to Denial of Service (DoS) via Uncontrolled Recursion

Published Mar 20, 2026 · Updated Mar 20, 2026 · Assigned by GitHub_M

Description

AutoMapper is a convention-based object-object mapper in .NET. Versions prior to 15.1.1 and 16.1.1 are vulnerable to a Denial of Service (DoS) attack. When mapping deeply nested object graphs, the library uses recursive method calls without enforcing a default maximum depth limit. This allows an attacker to provide a specially crafted object graph that exhausts the thread's stack memory, triggering a `StackOverflowException` and causing the entire application process to terminate. Versions 15.1.1 and 16.1.1 fix the issue.

Affected products

VendorProductAffectedFixed
LuckyPennySoftware AutoMapper >= 16.0.0, < 16.1.1, < 15.1.1 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Wolfi

ReleasePackageFixed inAdvisory
Wolfi rolling promitor 2.16.0-r0 —

Affected packages

EcosystemPackageAffectedFixedRecord
NuGet AutoMapper >= 16.0.0, < 16.1.1 16.1.1 GHSA-rvv3-g6hj-g44x
NuGet AutoMapper < 15.1.1 15.1.1 GHSA-rvv3-g6hj-g44x

References