Stack Overflow Vulnerability in AutoMapper Affects .NET Applications
CVE-2026-128081
7.5HIGH
What is CVE-2026-128081?
AutoMapper, a convention-based object-object mapper for .NET, presents a vulnerability that allows for uncontrolled recursion. This occurs when mapping polymorphic graphs using Include or IncludeBase, as well as when utilizing runtime-typed object or interface members, nested Dictionary<string, object>, or ExpandoObject sources. Attackers can exploit deep, influenced graphs in these scenarios, resulting in an uncatchable StackOverflowException, which may terminate the application process. This issue has been addressed in AutoMapper versions 15.1.4 and 16.3.0.
Affected Version(s)
AutoMapper >= 16.0.0, < 16.3.0 < 16.0.0, 16.3.0
AutoMapper < 15.1.4 < 15.1.4