CVE-2026-32933

AutoMapper is vulnerable to a Denial of Service (DoS) attack. When mapping deeply nested object graphs, the library uses recursive method calls without enforcing a default maximum depth limit. This allows an attacker to provide a specially crafted object graph that exhausts the thread's stack memory, triggering a StackOverflowException and causing the entire application process to terminate.

Description

The vulnerability exists in the core mapping engine. When a source object contains a property of the same type (or a type that eventually points back to itself), AutoMapper recursively attempts to map each level.

Because there is no default limit on how many levels deep this recursion can go, a sufficiently nested object (approximately 25,000+ levels in standard .NET environments) will exceed the stack size. Since StackOverflowException cannot be caught in modern .NET runtimes, the application cannot recover and will crash immediately.

Proof of Concept (PoC)

The following C# code demonstrates the crash by creating a nested "Circular" object graph and attempting to map it:

class Circular { public Circular Self { get; set; } }

// Setup configuration
var config = new MapperConfiguration(cfg => {
    cfg.CreateMap<Circular, Circular>();
});
var mapper = config.CreateMapper();

// Create a deeply nested object (28,000+ levels)
var root = new Circular();
var current = root;
for (int i = 0; i < 30000; i++) {
    current.Self = new Circular();
    current = current.Self;
}

// This call triggers the StackOverflowException and crashes the process
mapper.Map<Circular>(root);

Recommended Mitigation

1. Secure Defaults: Implement a default MaxDepth (e.g., 32 or 64) for all mapping operations.
2. Configurable Limit: Allow users to increase this limit if necessary, but ensure it is enabled by default to protect unsuspecting developers.

• Availability: An attacker can crash the application server, leading to a complete Denial of Service.
• Process Termination: Unlike standard exceptions, this terminates the entire process, not just the individual request thread.

CVE-2026-32933 has a CVSS score of 7.5 (High). The vector is network-reachable, no privileges required, and no user interaction. A CVSS score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether this affects your application depends on whether the vulnerable code is present and reachable in your environment. A fixed version is available (16.1.1, 15.1.1); upgrading removes the vulnerable code path.

Kodem intelligence

1. What is CVE-2026-32933? CVE-2026-32933 is a high-severity security vulnerability in AutoMapper (nuget), affecting versions >= 16.0.0, < 16.1.1. It is fixed in 16.1.1, 15.1.1.
2. How severe is CVE-2026-32933? CVE-2026-32933 has a CVSS score of 7.5 (High). This score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether it represents real risk in your environment depends on whether the vulnerable code is present and reachable.
3. Which versions of AutoMapper are affected by CVE-2026-32933? AutoMapper (nuget) versions >= 16.0.0, < 16.1.1 is affected.
4. Is there a fix for CVE-2026-32933? Yes. CVE-2026-32933 is fixed in 16.1.1, 15.1.1. Upgrade to this version or later.
5. Is CVE-2026-32933 exploitable, and should I be worried? Whether CVE-2026-32933 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
6. What actually determines whether CVE-2026-32933 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
7. How do I fix CVE-2026-32933?
   • Upgrade AutoMapper to 16.1.1 or later
   • Upgrade AutoMapper to 15.1.1 or later