CVE-2026-128081

Description

AutoMapper is a convention-based object-object mapper in .NET. Prior to 15.1.4 and from 16.0.0 until 16.3.0, AutoMapper can recurse without an effective MaxDepth limit when mapping polymorphic graphs through Include or IncludeBase, runtime-typed object or interface members, nested Dictionary<string, object> or ExpandoObject sources, or recursive ConvertUsing type converters. Deep attacker-influenced graphs on these paths can throw an uncatchable StackOverflowException and terminate the process. This issue is fixed in versions 15.1.4 and 16.3.0.

References

• https://github.com/LuckyPennySoftware/AutoMapper/commit/aee81b50574c3c7005283cca2b2396e295bd8ed9
• https://github.com/LuckyPennySoftware/AutoMapper/commit/bdbbf5967d20d28e611ab65de1d96d1047a95ab9
• https://github.com/LuckyPennySoftware/AutoMapper/releases/tag/v15.1.4
• https://github.com/LuckyPennySoftware/AutoMapper/releases/tag/v16.3.0
• https://github.com/LuckyPennySoftware/AutoMapper/security/advisories/GHSA-gpwp-5797-mjff