{"id":"CVE-2026-128081","aliases":[],"url":"https://o3.security/vulnerability/CVE-2026-128081","summary":"AutoMapper is a convention-based object-object mapper in .NET. Prior to 15.1.4 and from 16.0.0 until 16.3.0, AutoMapper can recurse without an effective MaxDepth limit when mapping…","details":"AutoMapper is a convention-based object-object mapper in .NET. Prior to 15.1.4 and from 16.0.0 until 16.3.0, AutoMapper can recurse without an effective MaxDepth limit when mapping polymorphic graphs through Include or IncludeBase, runtime-typed object or interface members, nested Dictionary<string, object> or ExpandoObject sources, or recursive ConvertUsing type converters. Deep attacker-influenced graphs on these paths can throw an uncatchable StackOverflowException and terminate the process. This issue is fixed in versions 15.1.4 and 16.3.0.","published":"2026-11-13T18:35:45.452Z","modified":"2026-11-13T18:35:45.452Z","cvss":{"score":7.5,"severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[],"fix":{"url":"https://github.com/LuckyPennySoftware/AutoMapper/commit/aee81b50574c3c7005283cca2b2396e295bd8ed9","label":"LuckyPennySoftware/AutoMapper@aee81b5"},"references":[{"type":"WEB","url":"https://github.com/LuckyPennySoftware/AutoMapper/security/advisories/GHSA-gpwp-5797-mjff"},{"type":"WEB","url":"https://github.com/LuckyPennySoftware/AutoMapper/commit/aee81b50574c3c7005283cca2b2396e295bd8ed9"},{"type":"WEB","url":"https://github.com/LuckyPennySoftware/AutoMapper/commit/bdbbf5967d20d28e611ab65de1d96d1047a95ab9"},{"type":"WEB","url":"https://github.com/LuckyPennySoftware/AutoMapper/releases/tag/v15.1.4"},{"type":"WEB","url":"https://github.com/LuckyPennySoftware/AutoMapper/releases/tag/v16.3.0"}],"provenance":{"sources":["OSV.dev","NVD","FIRST.org (EPSS)"],"lastVerified":"2026-11-13T18:35:45.452Z"}}