CVE-2026-128081: AutoMapper: Denial of Service via uncontrolled recursion that bypasses MaxDepth
Summary The default and explicit MaxDepth limits added for CVE-2026-32933 don't apply to several mapping paths. Mapping a deeply nested source through any of them recurses without bound and throws a StackOverflowException, which can't be caught and terminates the process.
Affected paths - Polymorphic maps: derived type maps (Include / IncludeBase) didn't inherit the base map's MaxDepth, and the default limit for self-referential maps was only applied to the base map. A chain of derived objects was mapped without a limit, even with MaxDepth set on the base map. - Runtime-typed members: members typed as object or an interface aren't seen by self-reference detection, so the default limit isn't applied. - Dictionary and dynamic sources: mapping a nested Dictionary<string, object> or ExpandoObject (for example, deserialized JSON) onto typed destinations recurses with no depth tracking. MaxDepth has no effect. - Recursive type converters: ConvertUsing that calls context.Mapper.Map ignores MaxDepth.
Impact An application that maps attacker-influenced, deeply nested data through one of these paths can be crashed. On a 1 MB stack (the Windows default), a few thousand levels of nesting are enough.
Fix - Derived type maps inherit MaxDepth, and the default limit is applied to them. - Every runtime map call checks for sufficient stack, and fails with a catchable InsufficientExecutionStackException instead of overflowing.
Workarounds Set MaxDepth explicitly on derived maps and on maps reached through object or interface members. There is no configuration workaround for dictionary or dynamic sources, or for recursive type converters, other than limiting input depth before mapping.
Related - CVE-2026-32933 (GHSA-rvv3-g6hj-g44x) - GHSA-6vhm-j9h7-f9gh: MaxDepth not enforced through constructor parameters and positional records, fixed in the same releases.
Other sources
AutoMapper is a convention-based object-object mapper in .NET. Prior to 15.1.4 and from 16.0.0 until 16.3.0, AutoMapper can recurse without an effective MaxDepth limit when mapping polymorphic graphs through Include or IncludeBase, runtime-typed object or interface members, nested Dictionary<string, object> or ExpandoObject sources, or recursive ConvertUsing type converters. Deep attacker-influenced graphs on these paths can throw an uncatchable StackOverflowException and terminate the process. This issue is fixed in versions 15.1.4 and 16.3.0.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
nuget/AutoMapperto a version that resolves this vulnerability.Fixed in 15.1.4 - Upgrade
Upgrade
nuget/AutoMapperto a version that resolves this vulnerability.Fixed in 16.3.0 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 15.1.4 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 16.3.0 - Configuration
Set MaxDepth explicitly on derived maps and on maps reached through object or interface members.
AutoMapper MaxDepth = Set an explicit finite limit - Compensating control
Limit input depth before mapping nested dictionary or dynamic sources, or data handled by recursive ConvertUsing type converters.
Event History
Frequently Asked Questions
Which applications are exposed to process termination?
Applications are exposed if they map attacker-influenced, deeply nested data through an affected mapping path. The unbounded recursion throws a StackOverflowException that cannot be caught and terminates the process.
Does configuring MaxDepth prevent the crash?
No. Both default and explicit MaxDepth limits are bypassed on the affected paths: polymorphic derived maps, runtime-typed object or interface members, dictionary or ExpandoObject sources, and recursive ConvertUsing converters that call context.Mapper.Map.
What kinds of input should be reviewed during triage?
Review mappings of deeply nested polymorphic object chains, members declared as object or interfaces, nested Dictionary<string, object> or ExpandoObject data such as deserialized JSON, and custom converters that recursively invoke context.Mapper.Map.