Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

NuGet package

automapper

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. High, CVSS 7.5NuGetPublished

    AutoMapper Vulnerable to Denial of Service (DoS) via Uncontrolled Recursion

    CVE-2026-32933 · GHSA-rvv3-g6hj-g44x

    Affected
    • NuGet automapper >= 16.0.0, < 16.1.1; < 15.1.1
    Fixed in
    15.1.116.1.1· Vendor fix available
    Issue
    AutoMapper is vulnerable to a Denial of Service (DoS) attack. When mapping deeply nested object graphs, the library uses recursive method calls without enforcing a default maximum depth limit. This allows an attacker to provide a specially crafted object graph that exhausts the thread's stack memory, triggering a StackOverflowException and causing the entire application process to terminate. Description The vulnerability exists in the core mapping engine. When a source object contains a property of the same type (or a type that eventually points back to itself), AutoMapper recursively attempts to map each level. Because there is no default limit on how many levels deep this recursion can go, a sufficiently nested object (approximately 25,000+ levels in standard .NET environments) will exceed the stack size. Since StackOverflowException cannot be caught in modern .NET runtimes, the application cannot recover and will crash immediately. Impact Availability: An attacker can…

    Recommended action: Upgrade to 16.1.1 or 15.1.1 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →