CVE-2026-32933: AutoMapper Denial of Service Vulnerability

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-rvv3-g6hj-g44x",
  "modified" : "2026-03-25T18:53:07Z",
  "published" : "2026-03-13T20:57:07Z",
  "aliases" : [ "CVE-2026-32933" ],
  "summary" : "AutoMapper Vulnerable to Denial of Service (DoS) via Uncontrolled Recursion",
  "details" : "### Summary\n\nAutoMapper is vulnerable to a Denial of Service (DoS) attack. When mapping deeply nested object graphs, the library uses recursive method calls without enforcing a default maximum depth limit. This allows an attacker to provide a specially crafted object graph that exhausts the thread's stack memory, triggering a `StackOverflowException` and causing the entire application process to terminate.\n\n### Description\n\nThe vulnerability exists in the core mapping engine. When a source object contains a property of the same type (or a type that eventually points back to itself), AutoMapper recursively attempts to map each level.\n\nBecause there is no default limit on how many levels deep this recursion can go, a sufficiently nested object (approximately 25,000+ levels in standard .NET environments) will exceed the stack size. Since `StackOverflowException` cannot be caught in modern .NET runtimes, the application cannot recover and will crash immediately.\n\n### Impact\n\n* **Availability:** An attacker can crash the application server, leading to a complete Denial of Service.\n* **Process Termination:** Unlike standard exceptions, this terminates the entire process, not just the individual request thread.\n\n### Proof of Concept (PoC)\n\nThe following C# code demonstrates the crash by creating a nested \"Circular\" object graph and attempting to map it:\n\n```csharp\nclass Circular { public Circular Self { get; set; } }\n\n// Setup configuration\nvar config = new MapperConfiguration(cfg => {\n    cfg.CreateMap<Circular, Circular>();\n});\nvar mapper = config.CreateMapper();\n\n// Create a deeply nested object (28,000+ levels)\nvar root = new Circular();\nvar current = root;\nfor (int i = 0; i < 30000; i++) {\n    current.Self = new Circular();\n    current = current.Self;\n}\n\n// This call triggers the StackOverflowException and crashes the process\nmapper.Map<Circular>(root);\n\n```\n\n### Recommended Mitigation\n\n1. **Secure Defaults:** Implement a default `MaxDepth` (e.g., 32 or 64) for all mapping operations.\n2. **Configurable Limit:** Allow users to increase this limit if necessary, but ensure it is enabled by default to protect unsuspecting developers.",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "NuGet",
      "name" : "AutoMapper"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "16.0.0"
      }, {
        "fixed" : "16.1.1"
      } ]
    } ]
  }, {
    "package" : {
      "ecosystem" : "NuGet",
      "name" : "AutoMapper"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "15.1.1"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/LuckyPennySoftware/AutoMapper/security/advisories/GHSA-rvv3-g6hj-g44x"
  }, {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-32933"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/LuckyPennySoftware/AutoMapper/commit/0afaf1e91648fca1a57512e94dd00a76ee016816"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/LuckyPennySoftware/AutoMapper"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/LuckyPennySoftware/AutoMapper/discussions/4624"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/LuckyPennySoftware/AutoMapper/releases/tag/v15.1.1"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/LuckyPennySoftware/AutoMapper/releases/tag/v16.1.1"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-674" ],
    "severity" : "HIGH",
    "github_reviewed" : true,
    "github_reviewed_at" : "2026-03-13T20:57:07Z",
    "nvd_published_at" : "2026-03-20T03:16:00Z"
  }
}