{"id":"CVE-2026-128082","kind":"vulnerability","aliases":["CVE-2026-128082","GHSA-6vhm-j9h7-f9gh"],"related":[],"title":"AutoMapper: Uncontrolled Recursion with Constructor Parameters","description":"### Summary\n`MaxDepth`, whether set explicitly or applied by default (64) to self-referential type maps, was not enforced when the recursion goes through constructor parameters. Mapping a deeply nested source to a destination built through its constructor, such as a positional `record`, recurses without bound and throws a `StackOverflowException`. That exception can't be caught and terminates the process. This bypasses the mitigation for CVE-2026-32933.\n\n### Details\nThe type depth used by `MaxDepth` was incremented only after the destination object was created. Constructor parameters, including child objects of the same type, are mapped while the destination is created, so each level recursed before its parent was counted, and the depth check never tripped.\n\nAffected:\n- destination types mapped through constructor parameters, including positional records\n- both an explicit `MaxDepth(n)` and the default limit of 64\n- `ConstructUsing` that maps recursively through `context.Mapper`\n\nWith `MaxDepth(10)`, a 100-level chain was mapped to all 100 levels. On a 1 MB stack (the Windows default), the process crashed at between 1,000 and 2,000 levels.\n\n### PoC\nThe type only has a constructor with positional arguments, and `MaxDepth` is set to 10:\n\n```csharp\nusing AutoMapper;\n\n\n// Setup configuration - with MaxDepth set\nvar mapper = new MapperConfiguration(cfg =>\n    {\n        cfg.CreateMap<CircularClass, CircularClass>().MaxDepth(10);\n    })\n    .CreateMapper();\n\n// Create a deeply nested object (28,000+ levels)\nvar root = new CircularClass(null);\nvar current = root;\nfor (int i = 0; i < 30000; i++)\n{\n    current.Next = new CircularClass(null);\n    current = current.Next;\n}\n\n// STACK OVERFLOW even though the max depth is set\nvar mappedRoot = mapper.Map<CircularClass>(root);\n\n\npublic class CircularClass\n{\n    public CircularClass(CircularClass? Next)\n    {\n        this.Next = Next;\n    }\n\n    public CircularClass? Next { get; set; }\n}\n```\n\n### Impact\nAny application that maps attacker-influenced, deeply nested data to a destination type built through a constructor, with a recursive member, can be crashed. Setting `MaxDepth` as recommended for CVE-2026-32933 doesn't protect these mappings.\n\n### Patches\nFixed in 16.3.0 and 15.1.4. The depth is now counted before the destination is created, so constructor mapping stops at the same depth as property mapping.\n\n### Workarounds\nIf the destination type has a parameterless constructor and settable properties, `cfg.DisableConstructorMapping()` makes AutoMapper map through the properties, where `MaxDepth` is enforced. Positional records have no workaround other than limiting input depth before mapping, or upgrading.\n\n### Credits\nReported by @mcambria, who found it while writing a test to confirm their `MaxDepth` mitigation for CVE-2026-32933.\n\n### Related\n- CVE-2026-32933 (GHSA-rvv3-g6hj-g44x)\n- GHSA-gpwp-5797-mjff: other paths that bypassed `MaxDepth` (polymorphic maps, runtime-typed members, dictionary and dynamic sources, recursive type converters), fixed in the same releases.","summary":"AutoMapper's MaxDepth limit is not enforced when recursion goes through constructor parameters, such as positional records. Mapping deeply nested attacker-influenced data to such a type overflows the stack, which cannot be caught and terminates the process.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"AutoMapper","fixed":["16.3.0"],"affected":">= 16.0.0, < 16.3.0","ecosystem":"nuget"},{"name":"AutoMapper","fixed":["15.1.4"],"affected":"< 15.1.4","ecosystem":"nuget"}],"ecosystems":["nuget"],"tags":["automapper","csharp","cwe-674","dotnet","package","records"],"not_affected_if":["flat-or-trusted-input","no-recursive-constructor-types","versions-outside-range"],"how_to_check":"- Check the AutoMapper version in your lock file or `dotnet list package`; affected versions are 16.0.0 to below 16.3.0, and below 15.1.4.\n- Look for `CreateMap` calls on types with recursive members that are built through a constructor (positional records, `ConstructUsing` calling `context.Mapper`).\n- Check whether mapped input can come from outside and be deeply nested.","fix":"- AutoMapper 16.x: upgrade to `16.3.0`\n- AutoMapper 15.x: upgrade to `15.1.4`","status":"open","published_at":"2026-11-13T19:19:30+00:00","first_seen_at":"2026-11-13T19:23:54+00:00","triaged_at":"2026-11-13T19:24:55+00:00","updated_at":"2026-11-13T19:52:09+00:00","category":"package","confidence":0.85,"triage":{"at":"2026-11-13T19:24:55Z","model":"claude-haiku-5-5","output":{"fix":"- AutoMapper 16.x: upgrade to `16.3.0`\n- AutoMapper 15.x: upgrade to `15.1.4`","reach":"unknown","title":"AutoMapper: deep constructor-mapped input crashes the process via stack overflow","impact":"medium","summary":"AutoMapper's MaxDepth limit is not enforced when recursion goes through constructor parameters, such as positional records. Mapping deeply nested attacker-influenced data to such a type overflows the stack, which cannot be caught and terminates the process.","audience":"developers","category":"package","nicknames":[],"who_cares":["dotnet","automapper","csharp","records"],"confidence":0.85,"fix_status":"available","needs_auth":"unknown","worst_case":"Attacker crashes the whole process with unhandled stack overflow.","analyst_note":"","how_to_check":"- Check the AutoMapper version in your lock file or `dotnet list package`; affected versions are 16.0.0 to below 16.3.0, and below 15.1.4.\n- Look for `CreateMap` calls on types with recursive members that are built through a constructor (positional records, `ConstructUsing` calling `context.Mapper`).\n- Check whether mapped input can come from outside and be deeply nested.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["versions-outside-range","flat-or-trusted-input","no-recursive-constructor-types"],"who_is_affected":"Applications that use AutoMapper to map deeply nested, attacker-influenced data into a destination type created through a constructor that references its own type, such as a positional record. The MaxDepth setting does not protect these mappings. Applications that only map flat data, or whose inputs are trusted and shallow, are not exposed in practice.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000907,"input_tokens":5751,"output_tokens":663,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-128082':9A,17A '-2026':8A,16A,132C,363C,452C,456C '-32933':133C,364C,453C,457C '-674':23B '0':294C '000':235C,238C,281C '1':223C,234C '10':210C,255C,273C '100':212C,219C '15.1.4':375C '16.3.0':373C '2':237C '28':280C '30000':296C '5797':466C '64':75C,201C '6vhm':12A 'affect':181C 'appli':72C 'applic':333C 'argument':249C 'attack':48B,337C 'attacker-influenc':47B,336C 'automapp':1A,20B,27B,258C,411C 'automapper':18A,19A 'bound':111C 'built':100C,346C 'bypass':127C,471C 'cannot':59B 'caught':61B,121C 'cfg':268C 'cfg.createmap':269C 'cfg.disableconstructormapping':409C 'chain':214C 'check':178C 'child':153C 'circularclass':270C,271C,286C,300C,319C,321C,322C,327C 'class':318C 'configur':260C 'confirm':446C 'constructor':5A,38B,90C,103C,150C,186C,246C,349C,387C,405C 'constructus':202C 'context.mapper':207C 'convert':485C 'count':174C,380C 'crash':231C,356C 'creat':149C,165C,275C,385C 'createmapp':274C 'credit':434C 'csharp':21B,256C 'current':289C,302C 'current.next':298C,303C 'cve':7A,15A,131C,362C,451C,455C 'cwe':22B 'data':50B,341C 'deepli':45B,94C,277C,339C 'default':74C,198C,228C 'depth':137C,177C,310C,377C,393C,429C 'destin':99C,146C,163C,182C,344C,383C,400C 'detail':134C 'dictionari':479C 'doesn':365C 'dotnet':24B 'dynam':481C 'enforc':33B,84C,419C 'even':306C 'except':117C 'explicit':70C,193C 'f9gh':14A 'fix':371C,486C 'found':439C 'g44x':462C 'g6hj':461C 'get':329C 'ghsa':11A,459C,464C 'ghsa-6vhm-j9h7-f9gh':10A 'ghsa-gpwp':463C 'ghsa-rvv3-g6hj-g44x':458C 'goe':36B,88C 'gpwp':465C 'impact':331C 'includ':152C,188C 'increment':142C 'influenc':49B,338C 'input':428C 'int':292C 'j9h7':13A 'level':168C,213C,220C,239C,282C 'limit':30B,199C,427C 'make':410C 'map':44B,81C,92C,160C,184C,204C,216C,335C,369C,388C,396C,412C,431C,474C 'mappedroot':314C 'mapper':265C 'mapper.map':315C 'mapperconfigur':267C 'max':309C 'maxdepth':29B,67C,140C,194C,209C,251C,262C,272C,358C,417C,448C,472C 'mb':224C 'mcambria':437C 'member':353C,478C 'mitig':129C,449C 'mjff':467C 'n':195C 'nest':46B,95C,278C,340C 'never':179C 'new':266C,285C,299C 'next':323C,325C,328C 'null':287C,301C 'object':147C,154C,279C 'overflow':55B,305C 'packag':25B 'paramet':6A,39B,91C,151C,187C 'parameterless':404C 'parent':172C 'patch':370C 'path':469C 'poc':240C 'polymorph':473C 'posit':42B,107C,189C,248C,420C 'process':65B,125C,230C 'properti':395C,408C,415C 'protect':367C 'public':317C,320C,326C 'recommend':360C 'record':26B,43B,108C,190C,421C 'recurs':3A,35B,87C,109C,169C,205C,352C,483C 'referenti':79C 'relat':454C 'releas':490C 'report':435C 'root':284C,290C,316C 'runtim':476C 'runtime-typ':475C 'rvv3':460C 'self':78C 'self-referenti':77C 'set':69C,253C,263C,312C,330C,357C 'settabl':407C 'setup':259C 'sourc':96C,482C 'stack':57B,225C,304C 'stackoverflowexcept':115C 'stop':389C 'summari':66C 'termin':63B,123C 'test':444C 'this.next':324C 'though':307C 'throw':113C 'trip':180C 'type':54B,80C,136C,158C,183C,242C,345C,401C,477C,484C 'uncontrol':2A 'upgrad':433C 'use':138C,257C 'var':264C,283C,288C,313C 'whether':68C 'window':227C 'without':110C 'workaround':397C,424C 'write':442C","nicknames":[],"mitigations":[],"who_affected":"Applications that use AutoMapper to map deeply nested, attacker-influenced data into a destination type created through a constructor that references its own type, such as a positional record. The MaxDepth setting does not protect these mappings. Applications that only map flat data, or whose inputs are trusted and shallow, are not exposed in practice.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":["automapper"],"ptokens":["automapper"],"labels":["automapper","csharp","cwe674","dotnet","high","nuget","package","records"],"campaign_type":null,"search_a":"'-128082':9A,17A '-2026':8A,16A '6vhm':12A 'automapp':1A 'automapper':18A,19A 'constructor':5A 'cve':7A,15A 'f9gh':14A 'ghsa':11A 'ghsa-6vhm-j9h7-f9gh':10A 'j9h7':13A 'paramet':6A 'recurs':3A 'uncontrol':2A","search_b":"'-674':23B 'attack':48B 'attacker-influenc':47B 'automapp':20B,27B 'cannot':59B 'caught':61B 'constructor':38B 'csharp':21B 'cwe':22B 'data':50B 'deepli':45B 'dotnet':24B 'enforc':33B 'goe':36B 'influenc':49B 'limit':30B 'map':44B 'maxdepth':29B 'nest':46B 'overflow':55B 'packag':25B 'paramet':39B 'posit':42B 'process':65B 'record':26B,43B 'recurs':35B 'stack':57B 'termin':63B 'type':54B","search_c":"'-2026':132C,363C,452C,456C '-32933':133C,364C,453C,457C '0':294C '000':235C,238C,281C '1':223C,234C '10':210C,255C,273C '100':212C,219C '15.1.4':375C '16.3.0':373C '2':237C '28':280C '30000':296C '5797':466C '64':75C,201C 'affect':181C 'appli':72C 'applic':333C 'argument':249C 'attack':337C 'attacker-influenc':336C 'automapp':258C,411C 'bound':111C 'built':100C,346C 'bypass':127C,471C 'caught':121C 'cfg':268C 'cfg.createmap':269C 'cfg.disableconstructormapping':409C 'chain':214C 'check':178C 'child':153C 'circularclass':270C,271C,286C,300C,319C,321C,322C,327C 'class':318C 'configur':260C 'confirm':446C 'constructor':90C,103C,150C,186C,246C,349C,387C,405C 'constructus':202C 'context.mapper':207C 'convert':485C 'count':174C,380C 'crash':231C,356C 'creat':149C,165C,275C,385C 'createmapp':274C 'credit':434C 'csharp':256C 'current':289C,302C 'current.next':298C,303C 'cve':131C,362C,451C,455C 'data':341C 'deepli':94C,277C,339C 'default':74C,198C,228C 'depth':137C,177C,310C,377C,393C,429C 'destin':99C,146C,163C,182C,344C,383C,400C 'detail':134C 'dictionari':479C 'doesn':365C 'dynam':481C 'enforc':84C,419C 'even':306C 'except':117C 'explicit':70C,193C 'fix':371C,486C 'found':439C 'g44x':462C 'g6hj':461C 'get':329C 'ghsa':459C,464C 'ghsa-gpwp':463C 'ghsa-rvv3-g6hj-g44x':458C 'goe':88C 'gpwp':465C 'impact':331C 'includ':152C,188C 'increment':142C 'influenc':338C 'input':428C 'int':292C 'level':168C,213C,220C,239C,282C 'limit':199C,427C 'make':410C 'map':81C,92C,160C,184C,204C,216C,335C,369C,388C,396C,412C,431C,474C 'mappedroot':314C 'mapper':265C 'mapper.map':315C 'mapperconfigur':267C 'max':309C 'maxdepth':67C,140C,194C,209C,251C,262C,272C,358C,417C,448C,472C 'mb':224C 'mcambria':437C 'member':353C,478C 'mitig':129C,449C 'mjff':467C 'n':195C 'nest':95C,278C,340C 'never':179C 'new':266C,285C,299C 'next':323C,325C,328C 'null':287C,301C 'object':147C,154C,279C 'overflow':305C 'paramet':91C,151C,187C 'parameterless':404C 'parent':172C 'patch':370C 'path':469C 'poc':240C 'polymorph':473C 'posit':107C,189C,248C,420C 'process':125C,230C 'properti':395C,408C,415C 'protect':367C 'public':317C,320C,326C 'recommend':360C 'record':108C,190C,421C 'recurs':87C,109C,169C,205C,352C,483C 'referenti':79C 'relat':454C 'releas':490C 'report':435C 'root':284C,290C,316C 'runtim':476C 'runtime-typ':475C 'rvv3':460C 'self':78C 'self-referenti':77C 'set':69C,253C,263C,312C,330C,357C 'settabl':407C 'setup':259C 'sourc':96C,482C 'stack':225C,304C 'stackoverflowexcept':115C 'stop':389C 'summari':66C 'termin':123C 'test':444C 'this.next':324C 'though':307C 'throw':113C 'trip':180C 'type':80C,136C,158C,183C,242C,345C,401C,477C,484C 'upgrad':433C 'use':138C,257C 'var':264C,283C,288C,313C 'whether':68C 'window':227C 'without':110C 'workaround':397C,424C 'write':442C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-05T15:34:47+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvss_by":"GitHub","poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-6vhm-j9h7-f9gh","url":"https://github.com/advisories/GHSA-6vhm-j9h7-f9gh","severity":"high","published_at":"2026-11-13T19:21:02+00:00","modified_at":"2026-11-13T19:21:03+00:00","first_seen_at":"2026-11-13T19:23:54+00:00","fetched_at":"2026-11-13T19:34:09+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-128082","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-128082","severity":null,"published_at":"2026-11-13T19:19:30+00:00","modified_at":"2026-11-13T19:19:30+00:00","first_seen_at":"2026-11-13T19:52:09+00:00","fetched_at":"2026-11-13T19:52:10+00:00","note":null}],"documents":[{"id":148903,"url":"https://api.github.com/repos/LuckyPennySoftware/AutoMapper/security-advisories/GHSA-6vhm-j9h7-f9gh","title":"Maintainer's advisory: api.github.com","kind":"vendor","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Maintainer's advisory: api.github.com"},{"id":148904,"url":"https://github.com/LuckyPennySoftware/AutoMapper/security/advisories/GHSA-6vhm-j9h7-f9gh","title":"Maintainer's advisory: github.com","kind":"vendor","source":"ghsa","publisher":"vendor","text":null,"published_at":"2026-11-05T15:34:47+00:00","relation":"advisory","confidence":null,"note":"Maintainer's advisory: github.com"},{"id":148905,"url":"https://github.com/LuckyPennySoftware/AutoMapper/commit/4d51a4b8125b4d2302f2f1f455747c9648ad1acb","title":"Patch: github.com","kind":"other","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":148906,"url":"https://github.com/LuckyPennySoftware/AutoMapper/commit/639c2748cb9d3d07df8b86879ba7bcf211675c86","title":"Patch: github.com","kind":"other","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":148555,"url":"https://github.com/LuckyPennySoftware/AutoMapper/releases/tag/v15.1.4","title":"Release: github.com","kind":"release","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release: github.com"},{"id":148556,"url":"https://github.com/LuckyPennySoftware/AutoMapper/releases/tag/v16.3.0","title":"Release: github.com","kind":"release","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release: github.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}