GHSA-gpwp-5797-mjff

Suggest an improvement
Source
https://github.com/advisories/GHSA-gpwp-5797-mjff
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-gpwp-5797-mjff/GHSA-gpwp-5797-mjff.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-gpwp-5797-mjff
Aliases
  • CVE-2026-128081
Published
2026-11-13T18:47:17Z
Modified
2026-11-13T19:15:07Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
AutoMapper: Denial of Service via uncontrolled recursion that bypasses MaxDepth
Details

Summary

The default and explicit MaxDepth limits added for CVE-2026-32933 don't apply to several mapping paths. Mapping a deeply nested source through any of them recurses without bound and throws a StackOverflowException, which can't be caught and terminates the process.

Affected paths

  • Polymorphic maps: derived type maps (Include / IncludeBase) didn't inherit the base map's MaxDepth, and the default limit for self-referential maps was only applied to the base map. A chain of derived objects was mapped without a limit, even with MaxDepth set on the base map.
  • Runtime-typed members: members typed as object or an interface aren't seen by self-reference detection, so the default limit isn't applied.
  • Dictionary and dynamic sources: mapping a nested Dictionary<string, object> or ExpandoObject (for example, deserialized JSON) onto typed destinations recurses with no depth tracking. MaxDepth has no effect.
  • Recursive type converters: ConvertUsing that calls context.Mapper.Map ignores MaxDepth.

Impact

An application that maps attacker-influenced, deeply nested data through one of these paths can be crashed. On a 1 MB stack (the Windows default), a few thousand levels of nesting are enough.

Fix

  • Derived type maps inherit MaxDepth, and the default limit is applied to them.
  • Every runtime map call checks for sufficient stack, and fails with a catchable InsufficientExecutionStackException instead of overflowing.

Workarounds

Set MaxDepth explicitly on derived maps and on maps reached through object or interface members. There is no configuration workaround for dictionary or dynamic sources, or for recursive type converters, other than limiting input depth before mapping.

Related

  • CVE-2026-32933 (GHSA-rvv3-g6hj-g44x)
  • GHSA-6vhm-j9h7-f9gh: MaxDepth not enforced through constructor parameters and positional records, fixed in the same releases.
Database specific 
{
    "cwe_ids": [
        "CWE-674"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-11-13T18:47:17Z",
    "nvd_published_at": null,
    "severity": "HIGH"
}
References

Affected packages

NuGet / AutoMapper

Package

Name
AutoMapper
View open source insights on deps.dev
Purl
pkg:nuget/AutoMapper

Affected ranges

Type
ECOSYSTEM
Events
Introduced
16.0.0
Fixed
16.3.0

Affected versions

16.*
16.0.0
16.1.0
16.1.1
16.2.0

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-gpwp-5797-mjff/GHSA-gpwp-5797-mjff.json"

NuGet / AutoMapper

Package

Name
AutoMapper
View open source insights on deps.dev
Purl
pkg:nuget/AutoMapper

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
15.1.4

Affected versions

1.*
1.1.0.118
1.1.1
1.1.2
2.*
2.0.0
2.1.1
2.1.262
2.1.265
2.1.266
2.1.267
2.2.0
2.2.1-ci10
2.2.1-ci1000
2.2.1-ci11
2.2.1-ci15
2.2.1-ci16
2.2.1-ci17
2.2.1-ci4
2.2.1-ci5
2.2.1-ci6
2.2.1-ci7
2.2.1-ci8
2.2.1-ci9
2.2.1-ci9000
2.2.1-ci9001
2.2.1-ci9002
2.2.1-ci9003
2.2.1-ci9004
2.2.1-ci9005
2.2.1-ci9006
2.2.1
2.2.24-ci
2.2.25-ci
3.*
3.0.0-ci1026
3.0.0-ci1028
3.0.0-ci1029
3.0.0-ci1031
3.0.0-ci1032
3.0.0-ci1033
3.0.0-ci1034
3.0.0-ci1035
3.0.0-ci1036
3.0.0-ci1037
3.0.0-ci1038
3.0.0-ci1039
3.0.0-ci1040
3.0.0-ci1041
3.0.0-ci1042
3.0.0-ci1043
3.0.0-ci1053
3.0.0
3.1.0-ci1014
3.1.0-ci1016
3.1.0-ci1017
3.1.0-ci1018
3.1.0-ci1019
3.1.0-ci1020
3.1.0-ci1021
3.1.0-ci1022
3.1.0-ci1023
3.1.0-ci1024
3.1.0-ci1026
3.1.0-ci1027
3.1.0-ci1032
3.1.0-ci1033
3.1.0-ci1034
3.1.0-ci1035
3.1.0-ci1036
3.1.0-ci1037
3.1.0-ci1038
3.1.0-ci1043
3.1.0-ci1044
3.1.0-ci1045
3.1.0-ci1046
3.1.0-ci1047
3.1.0-ci1048
3.1.0-ci1049
3.1.0-ci1050
3.1.0-ci1051
3.1.0-ci1053
3.1.0-ci1056
3.1.0-ci1058
3.1.0
3.1.1-ci1000
3.1.1-ci1003
3.1.1
3.2.0-ci1000
3.2.0-ci1001
3.2.0-ci1002
3.2.0-ci1003
3.2.0-ci1004
3.2.0-ci1005
3.2.0-ci1008
3.2.0-ci1009
3.2.0-ci1010
3.2.0-ci1011
3.2.0-ci1014
3.2.0-ci1015
3.2.0-ci1016
3.2.0-ci1017
3.2.0-ci1021
3.2.0-ci1022
3.2.0-ci1023
3.2.0-ci1024
3.2.0-ci1025
3.2.0-ci1026
3.2.0-ci1027
3.2.0-ci1028
3.2.0-ci1029
3.2.0-ci1030
3.2.0-ci1033
3.2.0-ci1034
3.2.0-ci1035
3.2.0-ci1036
3.2.0-ci1037
3.2.0-ci1038
3.2.0-ci1039
3.2.0-ci1040
3.2.0-ci1041
3.2.0-ci1042
3.2.0-ci1043
3.2.0
3.2.1-ci1000
3.2.1-ci1001
3.2.1-ci1002
3.2.1
3.3.0-ci1000
3.3.0-ci1001
3.3.0-ci1002
3.3.0-ci1003
3.3.0-ci1004
3.3.0-ci1005
3.3.0-ci1006
3.3.0-ci1007
3.3.0-ci1008
3.3.0-ci1009
3.3.0-ci1016
3.3.0-ci1017
3.3.0-ci1018
3.3.0-ci1019
3.3.0-ci1020
3.3.0-ci1021
3.3.0-ci1022
3.3.0-ci1023
3.3.0-ci1024
3.3.0-ci1025
3.3.0-ci1026
3.3.0-ci1027
3.3.0-ci1028
3.3.0-ci1029
3.3.0-ci1030
3.3.0-ci1031
3.3.0-ci1032
3.3.0-ci1033
3.3.0
3.3.1
4.*
4.0.0-alpha1
4.0.0-ci1002
4.0.0-ci1004
4.0.0-ci1006
4.0.0-ci1007
4.0.0-ci1014
4.0.0-ci1015
4.0.0-ci1017
4.0.0-ci1018
4.0.0-ci1019
4.0.0-ci1020
4.0.0-ci1021
4.0.0-ci1026
4.0.0-ci1031
4.0.0-ci1032
4.0.0-ci1034
4.0.0-ci1036
4.0.0-ci1038
4.0.0-ci1046
4.0.0-ci1049
4.0.0-ci1050
4.0.0-ci1051
4.0.0-ci1052
4.0.0-ci1053
4.0.0-ci1054
4.0.0-ci1056
4.0.0-ci1057
4.0.0-ci1061
4.0.0
4.0.1
4.0.2
4.0.3
4.0.4
4.1.0
4.1.1
4.2.0
4.2.1
5.*
5.0.0-beta-1
5.0.0
5.0.1
5.0.2
5.1.0
5.1.1
5.2.0
6.*
6.0.0
6.0.1
6.0.2
6.1.0
6.1.1
6.2.0
6.2.1
6.2.2
7.*
7.0.0-alpha-0001
7.0.0
7.0.1
8.*
8.0.0
8.1.0
8.1.1
9.*
9.0.0
10.*
10.0.0
10.1.0
10.1.1
11.*
11.0.0
11.0.1
12.*
12.0.0
12.0.1
13.*
13.0.0
13.0.1
14.*
14.0.0
15.*
15.0.0
15.0.1
15.1.0
15.1.1
15.1.2
15.1.3

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-gpwp-5797-mjff/GHSA-gpwp-5797-mjff.json"