CVE-2026-32933 Overview
AutoMapper, a widely-used convention-based object-object mapper in .NET, contains a Denial of Service (DoS) vulnerability in versions prior to 15.1.1 and 16.1.1. The library's mapping functionality uses recursive method calls without enforcing a default maximum depth limit when processing deeply nested object graphs. This architectural flaw allows an attacker to craft a specially designed object graph that exhausts the thread's stack memory, triggering a StackOverflowException and causing the entire application process to terminate.
Critical Impact
Applications using vulnerable AutoMapper versions can be completely crashed by an attacker supplying maliciously crafted deeply nested input objects, resulting in service unavailability.
Affected Products
- AutoMapper versions prior to 15.1.1
- AutoMapper versions 16.x prior to 16.1.1
- .NET applications utilizing affected AutoMapper library versions
Discovery Timeline
- 2026-03-20 - CVE-2026-32933 published to NVD
- 2026-03-20 - Last updated in NVD database
Technical Details for CVE-2026-32933
Vulnerability Analysis
This vulnerability stems from uncontrolled recursion (CWE-674) within the AutoMapper library's object mapping engine. When the library processes object graphs—particularly those with circular references or deeply nested hierarchies—it utilizes recursive method calls to traverse and map each level of the object structure. Without a configurable or default maximum depth limit, the recursion can continue indefinitely until the thread's stack memory is exhausted.
The attack surface is network-accessible, requiring no authentication or user interaction. An attacker can exploit this vulnerability by providing specially crafted input data to any API endpoint or service that uses AutoMapper to process incoming objects. The impact is availability-focused, with no direct confidentiality or integrity implications, but the consequence—complete process termination—makes this a significant risk for production systems.
Root Cause
The root cause is the absence of a default maximum recursion depth limit in AutoMapper's mapping engine. When mapping operations encounter deeply nested or circular object structures, the library continues to allocate stack frames for each recursive call without bounds checking. The .NET runtime's stack has a finite size (typically 1MB for regular threads), and when this limit is exceeded, a StackOverflowException is thrown. Unlike most exceptions in .NET, StackOverflowException cannot be caught and results in immediate process termination.
Attack Vector
The attack vector is network-based, allowing remote exploitation without requiring authentication or privileges. An attacker can target any application endpoint that accepts user-controlled data which is subsequently processed through AutoMapper's mapping functionality.
The vulnerability is exploited by constructing an object graph with extreme nesting depth. This could be achieved through:
- JSON or XML payloads with thousands of nested child objects
- Objects with circular references that cause infinite recursion
- Data structures specifically designed to maximize recursion depth per stack frame
When such a payload is deserialized and passed to AutoMapper for mapping operations, the recursive traversal exhausts available stack memory. Unlike heap exhaustion attacks that may be recoverable, stack overflow causes unrecoverable process termination, making this a highly effective denial of service mechanism.
For technical implementation details, refer to the GitHub Security Advisory GHSA-rvv3-g6hj-g44x and the associated security commit.
Detection Methods for CVE-2026-32933
Indicators of Compromise
- Application process crashes with StackOverflowException in event logs or crash dumps
- Repeated application restarts in containerized or service-managed environments
- Crash dump analysis showing deep call stacks within AutoMapper namespace methods
- Increased frequency of process terminations correlating with specific API endpoint requests
Detection Strategies
- Monitor application crash logs for StackOverflowException events associated with AutoMapper assemblies
- Implement request payload size and nesting depth validation at API gateway or middleware layer
- Use software composition analysis (SCA) tools to identify vulnerable AutoMapper versions in dependencies
- Configure application performance monitoring (APM) to alert on recursive call depth anomalies
Monitoring Recommendations
- Enable Windows Event Log or Linux syslog monitoring for application crash events
- Implement health check endpoints with alerting for repeated application unavailability
- Monitor container orchestration platforms for excessive pod restarts or crash loops
- Track NuGet package versions across deployments to identify instances running vulnerable AutoMapper versions
How to Mitigate CVE-2026-32933
Immediate Actions Required
- Upgrade AutoMapper to version 15.1.1 or 16.1.1 depending on your current major version
- Audit all application dependencies to identify AutoMapper usage and version
- Implement input validation to reject payloads with excessive nesting depth before mapping operations
- Consider implementing request timeout and resource limits at the application or container level
Patch Information
The vulnerability has been addressed in AutoMapper versions 15.1.1 and 16.1.1. The fix introduces proper recursion depth limiting to prevent stack exhaustion during object graph traversal.
Security updates are available through the following channels:
Workarounds
- Implement middleware or API gateway rules to validate and limit JSON/XML nesting depth in incoming requests
- Add input sanitization logic to reject objects exceeding a reasonable depth threshold before passing to AutoMapper
- Consider isolating AutoMapper operations in separate worker processes to limit blast radius of potential crashes
- Implement rate limiting on endpoints that process complex object mappings
# Update AutoMapper via .NET CLI
dotnet add package AutoMapper --version 15.1.1
# Or for 16.x branch
dotnet add package AutoMapper --version 16.1.1
# Verify installed version
dotnet list package | grep AutoMapper
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
