{"id":"CVE-2026-32933","aliases":["GHSA-rvv3-g6hj-g44x"],"url":"https://o3.security/vulnerability/CVE-2026-32933","summary":"AutoMapper Vulnerable to Denial of Service (DoS) via Uncontrolled Recursion","details":"### Summary\n\nAutoMapper is vulnerable to a Denial of Service (DoS) attack. When mapping deeply nested object graphs, the library uses recursive method calls without enforcing a default maximum depth limit. This allows an attacker to provide a specially crafted object graph that exhausts the thread's stack memory, triggering a `StackOverflowException` and causing the entire application process to terminate.\n\n### Description\n\nThe vulnerability exists in the core mapping engine. When a source object contains a property of the same type (or a type that eventually points back to itself), AutoMapper recursively attempts to map each level.\n\nBecause there is no default limit on how many levels deep this recursion can go, a sufficiently nested object (approximately 25,000+ levels in standard .NET environments) will exceed the stack size. Since `StackOverflowException` cannot be caught in modern .NET runtimes, the application cannot recover and will crash immediately.\n\n### Impact\n\n* **Availability:** An attacker can crash the application server, leading to a complete Denial of Service.\n* **Process Termination:** Unlike standard exceptions, this terminates the entire process, not just the individual request thread.\n\n### Proof of Concept (PoC)\n\nThe following C# code demonstrates the crash by creating a nested \"Circular\" object graph and attempting to map it:\n\n```csharp\nclass Circular { public Circular Self { get; set; } }\n\n// Setup configuration\nvar config = new MapperConfiguration(cfg => {\n    cfg.CreateMap<Circular, Circular>();\n});\nvar mapper = config.CreateMapper();\n\n// Create a deeply nested object (28,000+ levels)\nvar root = new Circular();\nvar current = root;\nfor (int i = 0; i < 30000; i++) {\n    current.Self = new Circular();\n    current = current.Self;\n}\n\n// This call triggers the StackOverflowException and crashes the process\nmapper.Map<Circular>(root);\n\n```\n\n### Recommended Mitigation\n\n1. **Secure Defaults:** Implement a default `MaxDepth` (e.g., 32 or 64) for all mapping operations.\n2. **Configurable Limit:** Allow users to increase this limit if necessary, but ensure it is enabled by default to protect unsuspecting developers.","published":"2026-03-20T02:38:41.105Z","modified":"2026-08-12T03:51:12.989220911Z","cvss":{"score":7.5,"severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},"epss":{"score":0.00542,"percentile":0.43127,"asOf":"2026-08-24"},"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"NuGet","name":"AutoMapper","fixedVersion":"16.1.1"},{"ecosystem":"NuGet","name":"AutoMapper","fixedVersion":"15.1.1"}],"fix":{"url":"https://github.com/LuckyPennySoftware/AutoMapper/commit/0afaf1e91648fca1a57512e94dd00a76ee016816","label":"LuckyPennySoftware/AutoMapper@0afaf1e"},"references":[{"type":"WEB","url":"https://github.com/LuckyPennySoftware/AutoMapper/releases/tag/v15.1.1"},{"type":"WEB","url":"https://github.com/LuckyPennySoftware/AutoMapper/releases/tag/v16.1.1"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/32xxx/CVE-2026-32933.json"},{"type":"ADVISORY","url":"https://github.com/LuckyPennySoftware/AutoMapper/security/advisories/GHSA-rvv3-g6hj-g44x"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-32933"},{"type":"FIX","url":"https://github.com/LuckyPennySoftware/AutoMapper/commit/0afaf1e91648fca1a57512e94dd00a76ee016816"},{"type":"PACKAGE","url":"https://github.com/LuckyPennySoftware/AutoMapper"},{"type":"WEB","url":"https://github.com/LuckyPennySoftware/AutoMapper/discussions/4624"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-12T03:51:12.989220911Z"}}