{"id":"CVE-2026-128081","kind":"vulnerability","aliases":["CVE-2026-128081","GHSA-gpwp-5797-mjff"],"related":[],"title":"AutoMapper: Denial of Service via uncontrolled recursion that bypasses MaxDepth","description":"### Summary\nThe default and explicit `MaxDepth` limits added for CVE-2026-32933 don't apply to several mapping paths. Mapping a deeply nested source through any of them recurses without bound and throws a `StackOverflowException`, which can't be caught and terminates the process.\n\n### Affected paths\n- **Polymorphic maps:** derived type maps (`Include` / `IncludeBase`) didn't inherit the base map's `MaxDepth`, and the default limit for self-referential maps was only applied to the base map. A chain of derived objects was mapped without a limit, even with `MaxDepth` set on the base map.\n- **Runtime-typed members:** members typed as `object` or an interface aren't seen by self-reference detection, so the default limit isn't applied.\n- **Dictionary and dynamic sources:** mapping a nested `Dictionary<string, object>` or `ExpandoObject` (for example, deserialized JSON) onto typed destinations recurses with no depth tracking. `MaxDepth` has no effect.\n- **Recursive type converters:** `ConvertUsing` that calls `context.Mapper.Map` ignores `MaxDepth`.\n\n### Impact\nAn application that maps attacker-influenced, deeply nested data through one of these paths can be crashed. On a 1 MB stack (the Windows default), a few thousand levels of nesting are enough.\n\n### Fix\n- Derived type maps inherit `MaxDepth`, and the default limit is applied to them.\n- Every runtime map call checks for sufficient stack, and fails with a catchable `InsufficientExecutionStackException` instead of overflowing.\n\n### Workarounds\nSet `MaxDepth` explicitly on derived maps and on maps reached through `object` or interface members. There is no configuration workaround for dictionary or dynamic sources, or for recursive type converters, other than limiting input depth before mapping.\n\n### Related\n- CVE-2026-32933 (GHSA-rvv3-g6hj-g44x)\n- GHSA-6vhm-j9h7-f9gh: `MaxDepth` not enforced through constructor parameters and positional records, fixed in the same releases.","summary":"AutoMapper's MaxDepth limits from CVE-2026-32933 do not cover several mapping paths, including derived type maps, object-typed members, dictionary and dynamic sources, and recursive converters. Mapping attacker-influenced deeply nested data through these paths causes a StackOverflowException that cannot be caught and terminates the process.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"AutoMapper","fixed":["16.3.0"],"affected":">= 16.0.0, < 16.3.0","ecosystem":"nuget"},{"name":"AutoMapper","fixed":["15.1.4"],"affected":"< 15.1.4","ecosystem":"nuget"}],"ecosystems":["nuget"],"tags":["automapper","cwe-674","dotnet","nuget","package","web-api"],"not_affected_if":["shallow-data","trusted-input-only"],"how_to_check":"- Check the AutoMapper version in the project's package references or lock file (for example `dotnet list package`); affected versions are `>= 16.0.0, < 16.3.0` and `< 15.1.4`.\n- Look for `Include` or `IncludeBase` maps, members typed as `object` or interfaces, `ConvertUsing` calls that invoke `context.Mapper.Map`, and mapping of `Dictionary<string, object>` or `ExpandoObject` from untrusted JSON.","fix":"- AutoMapper `16.3.0` for the 16.x line\n- AutoMapper `15.1.4` for the 15.x line","status":"open","published_at":"2026-11-13T18:47:17+00:00","first_seen_at":"2026-11-13T18:48:07+00:00","triaged_at":"2026-11-13T18:49:11+00:00","updated_at":"2026-11-13T18:49:12+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-13T18:49:11Z","model":"claude-haiku-5-5","output":{"fix":"- AutoMapper `16.3.0` for the 16.x line\n- AutoMapper `15.1.4` for the 15.x line","reach":"internet","title":"AutoMapper: deeply nested input crashes the .NET process via recursion","impact":"medium","summary":"AutoMapper's MaxDepth limits from CVE-2026-32933 do not cover several mapping paths, including derived type maps, object-typed members, dictionary and dynamic sources, and recursive converters. Mapping attacker-influenced deeply nested data through these paths causes a StackOverflowException that cannot be caught and terminates the process.","audience":"businesses","category":"package","nicknames":[],"who_cares":["dotnet","nuget","automapper","web-api"],"confidence":0.8,"fix_status":"available","needs_auth":"unknown","worst_case":"Attacker crashes the application process with deeply nested input","analyst_note":"","how_to_check":"- Check the AutoMapper version in the project's package references or lock file (for example `dotnet list package`); affected versions are `>= 16.0.0, < 16.3.0` and `< 15.1.4`.\n- Look for `Include` or `IncludeBase` maps, members typed as `object` or interfaces, `ConvertUsing` calls that invoke `context.Mapper.Map`, and mapping of `Dictionary<string, object>` or `ExpandoObject` from untrusted JSON.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["trusted-input-only","shallow-data"],"who_is_affected":"Applications that use AutoMapper to map data from untrusted sources, such as deserialized JSON, where the input can be deeply nested. Exposure depends on whether one of the listed mapping paths is used with that input. Applications that map only trusted, shallow data are unlikely to be affected.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000877,"input_tokens":5331,"output_tokens":688,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-128081':13A,21A '-2026':12A,20A,39B,93C,347C '-32933':40B,94C,348C '-674':26B '1':262C '5797':17A '6vhm':356C 'add':90C 'affect':127C 'api':32B 'appli':97C,155C,203C,287C 'applic':243C 'aren':189C 'attack':64B,247C 'attacker-influenc':63B,246C 'automapp':1A,24B,33B 'automapper':22A,23A 'base':140C,158C,176C 'bound':113C 'bypass':9A 'call':237C,293C 'cannot':76B 'catchabl':302C 'caught':78B,122C 'caus':72B 'chain':161C 'check':294C 'configur':326C 'constructor':363C 'context.mapper.map':238C 'convert':61B,234C,337C 'convertus':235C 'cover':43B 'crash':259C 'cve':11A,19A,38B,92C,346C 'cwe':25B 'data':68B,251C 'deepli':66B,104C,249C 'default':85C,146C,199C,267C,284C 'denial':2A 'depth':226C,342C 'deriv':48B,131C,163C,277C,312C 'deseri':218C 'destin':222C 'detect':196C 'dictionari':55B,204C,211C,329C 'didn':136C 'dotnet':27B 'dynam':57B,206C,331C 'effect':231C 'enforc':361C 'enough':275C 'even':170C 'everi':290C 'exampl':217C 'expandoobject':215C 'explicit':87C,310C 'f9gh':358C 'fail':299C 'fix':276C,368C 'g44x':353C 'g6hj':352C 'ghsa':15A,350C,355C 'ghsa-6vhm-j9h7-f9gh':354C 'ghsa-gpwp':14A 'ghsa-rvv3-g6hj-g44x':349C 'gpwp':16A 'ignor':239C 'impact':241C 'includ':47B,134C 'includebas':135C 'influenc':65B,248C 'inherit':138C,280C 'input':341C 'instead':304C 'insufficientexecutionstackexcept':303C 'interfac':188C,321C 'isn':201C 'j9h7':357C 'json':219C 'level':271C 'limit':36B,89C,147C,169C,200C,285C,340C 'map':45B,50B,62B,100C,102C,130C,133C,141C,152C,159C,166C,177C,208C,245C,279C,292C,313C,316C,344C 'maxdepth':10A,35B,88C,143C,172C,228C,240C,281C,309C,359C 'mb':263C 'member':54B,181C,182C,322C 'mjff':18A 'nest':67B,105C,210C,250C,273C 'nuget':28B 'object':52B,164C,185C,213C,319C 'object-typ':51B 'one':253C 'onto':220C 'overflow':306C 'packag':29B 'paramet':364C 'path':46B,71B,101C,128C,256C 'polymorph':129C 'posit':366C 'process':82B,126C 'reach':317C 'record':367C 'recurs':7A,60B,111C,223C,232C,335C 'refer':195C 'referenti':151C 'relat':345C 'releas':372C 'runtim':179C,291C 'runtime-typ':178C 'rvv3':351C 'seen':191C 'self':150C,194C 'self-refer':193C 'self-referenti':149C 'servic':4A 'set':173C,308C 'sever':44B,99C 'sourc':58B,106C,207C,332C 'stack':264C,297C 'stackoverflowexcept':74B,117C 'string':212C 'suffici':296C 'summari':83C 'termin':80B,124C 'thousand':270C 'throw':115C 'track':227C 'type':49B,53B,132C,180C,183C,221C,233C,278C,336C 'uncontrol':6A 'via':5A 'web':31B 'web-api':30B 'window':266C 'without':112C,167C 'workaround':307C,327C","nicknames":[],"mitigations":[],"who_affected":"Applications that use AutoMapper to map data from untrusted sources, such as deserialized JSON, where the input can be deeply nested. Exposure depends on whether one of the listed mapping paths is used with that input. Applications that map only trusted, shallow data are unlikely to be affected.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["automapper"],"ptokens":["automapper"],"labels":["automapper","cwe674","dotnet","high","nuget","package","webapi"],"campaign_type":null,"search_a":"'-128081':13A,21A '-2026':12A,20A '5797':17A 'automapp':1A 'automapper':22A,23A 'bypass':9A 'cve':11A,19A 'denial':2A 'ghsa':15A 'ghsa-gpwp':14A 'gpwp':16A 'maxdepth':10A 'mjff':18A 'recurs':7A 'servic':4A 'uncontrol':6A 'via':5A","search_b":"'-2026':39B '-32933':40B '-674':26B 'api':32B 'attack':64B 'attacker-influenc':63B 'automapp':24B,33B 'cannot':76B 'caught':78B 'caus':72B 'convert':61B 'cover':43B 'cve':38B 'cwe':25B 'data':68B 'deepli':66B 'deriv':48B 'dictionari':55B 'dotnet':27B 'dynam':57B 'includ':47B 'influenc':65B 'limit':36B 'map':45B,50B,62B 'maxdepth':35B 'member':54B 'nest':67B 'nuget':28B 'object':52B 'object-typ':51B 'packag':29B 'path':46B,71B 'process':82B 'recurs':60B 'sever':44B 'sourc':58B 'stackoverflowexcept':74B 'termin':80B 'type':49B,53B 'web':31B 'web-api':30B","search_c":"'-2026':93C,347C '-32933':94C,348C '1':262C '6vhm':356C 'add':90C 'affect':127C 'appli':97C,155C,203C,287C 'applic':243C 'aren':189C 'attack':247C 'attacker-influenc':246C 'base':140C,158C,176C 'bound':113C 'call':237C,293C 'catchabl':302C 'caught':122C 'chain':161C 'check':294C 'configur':326C 'constructor':363C 'context.mapper.map':238C 'convert':234C,337C 'convertus':235C 'crash':259C 'cve':92C,346C 'data':251C 'deepli':104C,249C 'default':85C,146C,199C,267C,284C 'depth':226C,342C 'deriv':131C,163C,277C,312C 'deseri':218C 'destin':222C 'detect':196C 'dictionari':204C,211C,329C 'didn':136C 'dynam':206C,331C 'effect':231C 'enforc':361C 'enough':275C 'even':170C 'everi':290C 'exampl':217C 'expandoobject':215C 'explicit':87C,310C 'f9gh':358C 'fail':299C 'fix':276C,368C 'g44x':353C 'g6hj':352C 'ghsa':350C,355C 'ghsa-6vhm-j9h7-f9gh':354C 'ghsa-rvv3-g6hj-g44x':349C 'ignor':239C 'impact':241C 'includ':134C 'includebas':135C 'influenc':248C 'inherit':138C,280C 'input':341C 'instead':304C 'insufficientexecutionstackexcept':303C 'interfac':188C,321C 'isn':201C 'j9h7':357C 'json':219C 'level':271C 'limit':89C,147C,169C,200C,285C,340C 'map':100C,102C,130C,133C,141C,152C,159C,166C,177C,208C,245C,279C,292C,313C,316C,344C 'maxdepth':88C,143C,172C,228C,240C,281C,309C,359C 'mb':263C 'member':181C,182C,322C 'nest':105C,210C,250C,273C 'object':164C,185C,213C,319C 'one':253C 'onto':220C 'overflow':306C 'paramet':364C 'path':101C,128C,256C 'polymorph':129C 'posit':366C 'process':126C 'reach':317C 'record':367C 'recurs':111C,223C,232C,335C 'refer':195C 'referenti':151C 'relat':345C 'releas':372C 'runtim':179C,291C 'runtime-typ':178C 'rvv3':351C 'seen':191C 'self':150C,194C 'self-refer':193C 'self-referenti':149C 'set':173C,308C 'sever':99C 'sourc':106C,207C,332C 'stack':264C,297C 'stackoverflowexcept':117C 'string':212C 'suffici':296C 'summari':83C 'termin':124C 'thousand':270C 'throw':115C 'track':227C 'type':132C,180C,183C,221C,233C,278C,336C 'window':266C 'without':112C,167C 'workaround':307C,327C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-05T15:34:49+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvss_by":"GitHub","poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-gpwp-5797-mjff","url":"https://github.com/advisories/GHSA-gpwp-5797-mjff","severity":"high","published_at":"2026-11-13T18:47:17+00:00","modified_at":"2026-11-13T18:47:19+00:00","first_seen_at":"2026-11-13T18:48:07+00:00","fetched_at":"2026-11-13T18:58:26+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-128081","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-128081","severity":null,"published_at":"2026-11-13T19:19:30+00:00","modified_at":"2026-11-13T19:19:30+00:00","first_seen_at":"2026-11-13T19:52:09+00:00","fetched_at":"2026-11-13T19:52:10+00:00","note":null}],"documents":[{"id":148552,"url":"https://api.github.com/repos/LuckyPennySoftware/AutoMapper/security-advisories/GHSA-gpwp-5797-mjff","title":"Maintainer's advisory: api.github.com","kind":"vendor","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Maintainer's advisory: api.github.com"},{"id":148553,"url":"https://github.com/LuckyPennySoftware/AutoMapper/security/advisories/GHSA-gpwp-5797-mjff","title":"Maintainer's advisory: github.com","kind":"vendor","source":"ghsa","publisher":"vendor","text":null,"published_at":"2026-11-05T15:34:49+00:00","relation":"advisory","confidence":null,"note":"Maintainer's advisory: github.com"},{"id":148554,"url":"https://github.com/LuckyPennySoftware/AutoMapper/commit/aee81b50574c3c7005283cca2b2396e295bd8ed9","title":"Patch: github.com","kind":"other","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":148555,"url":"https://github.com/LuckyPennySoftware/AutoMapper/releases/tag/v15.1.4","title":"Release: github.com","kind":"release","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release: github.com"},{"id":148556,"url":"https://github.com/LuckyPennySoftware/AutoMapper/releases/tag/v16.3.0","title":"Release: github.com","kind":"release","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release: github.com"},{"id":149133,"url":"https://github.com/LuckyPennySoftware/AutoMapper/commit/bdbbf5967d20d28e611ab65de1d96d1047a95ab9","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}