StackOverflow Exception in AutoMapper Due to Recursive Mapping Issues
CVE-2026-128082
7.5HIGH
What is CVE-2026-128082?
AutoMapper, a convention-based object-object mapper in .NET, contains a vulnerability that allows deep attacker-influenced input to trigger an unhandled StackOverflowException. This issue arises because the mapping process increments the type depth only after the destination is created, allowing recursive mappings through constructor parameters to circumvent specified MaxDepth restrictions. Consequently, this can result in a crash of the application process. This vulnerability is addressed in AutoMapper versions 15.1.4 and 16.3.0, where proper checks on MaxDepth limit are applied.
Affected Version(s)
AutoMapper >= 16.0.0, < 16.3.0 < 16.0.0, 16.3.0
AutoMapper < 15.1.4 < 15.1.4