AutoMapper stack overflow vulnerability: check affected versions and upgrade to a fixed release

GitHub Advisories has published a vulnerability in AutoMapper, a .NET library for mapping data between objects. This article covers the affected versions, impact mechanism, and the checks and remediation steps in the advisory.

Overview and technical details

CVE-2026-128082 is an uncontrolled recursion flaw when mapping through constructor parameters. The advisory classifies it as CWE-674 and assigns a CVSS 3.1 score of 7.5.

Affected systems

Mechanism and impact

When mapping through constructor parameters, MaxDepth is not calculated before the destination object is created. As a result, both an explicitly configured limit and the default limit of 64 can be exceeded. Deep attacker-controlled input can cause an uncatchable StackOverflowException and terminate the application process.

The issue also affects ConstructUsing when mapping recursively through context.Mapper.

System checks

1. Check the AutoMapper version declared directly in the .NET project:

   Copy commands

   dotnet list package

   If the version is in an affected range, upgrade to 16.3.0 or 15.1.4 as appropriate.

2. Check NuGet dependencies included transitively:

   Copy commands

   dotnet list package --include-transitive

   If AutoMapper appears with an affected version, update the dependency to a fixed release.

Remediation and mitigation

1. Prioritize upgrading: move AutoMapper to 16.3.0 or 15.1.4, according to the version branch in use.

2. If an upgrade is not yet possible: limit input depth before mapping.

3. For destination types with a parameterless constructor and settable properties, cfg.DisableConstructorMapping() can be used temporarily to map through properties, where MaxDepth is enforced.

4. For positional records, the advisory identifies limiting input depth before mapping or upgrading; it provides no other workaround.

Source: GitHub Advisories — GHSA-6vhm-j9h7-f9gh.