CVE-2026-32933: AutoMapper uncontrolled recursion in core mapping engine

Executive brief

AutoMapper, a popular library used in .NET applications to transform data between different object types, is vulnerable to a Denial of Service (DoS) attack. An attacker can provide a specially crafted, deeply nested data structure that causes the application to crash by exhausting its memory. This crash terminates the entire application process, leading to a complete service outage for all users.

Technical details

AutoMapper is vulnerable to uncontrolled recursion (CWE-674) in its core mapping engine. When processing a source object with deeply nested properties of the same or circular types, the library fails to enforce a default maximum recursion depth. An attacker can exploit this by submitting a crafted object graph (typically exceeding 25,000 levels), which triggers a StackOverflowException in the .NET runtime. Because this exception cannot be caught in modern .NET environments, it results in immediate process termination. The vulnerability is addressed in versions 15.1.1 and 16.1.1 by implementing depth limits.

Affected products

• LuckyPennySoftware AutoMapper >= 16.0.0, < 16.1.1; < 15.1.1

Timeline

• 2026-03-13: advisory: GitHub Advisory GHSA-rvv3-g6hj-g44x published.
• 2026-03-13: patched: Versions 15.1.1 and 16.1.1 released.
• 2026-03-20: disclosed: NVD publication of CVE-2026-32933.

References

• https://api.github.com/users/jbogard
• https://github.com/jbogard
• https://api.github.com/users/jbogard/gists%7B/gist_id%7D
• https://api.github.com/users/jbogard/repos
• https://avatars.githubusercontent.com/u/104498?v=4
• https://api.github.com/users/jbogard/events%7B/privacy%7D