diff --git a/advisories/github-reviewed/2026/03/GHSA-rvv3-g6hj-g44x/GHSA-rvv3-g6hj-g44x.json b/advisories/github-reviewed/2026/03/GHSA-rvv3-g6hj-g44x/GHSA-rvv3-g6hj-g44x.json index 22a187f3a2d34..fb258adeaa770 100644 --- a/advisories/github-reviewed/2026/03/GHSA-rvv3-g6hj-g44x/GHSA-rvv3-g6hj-g44x.json +++ b/advisories/github-reviewed/2026/03/GHSA-rvv3-g6hj-g44x/GHSA-rvv3-g6hj-g44x.json @@ -1,11 +1,11 @@ { "schema_version": "1.4.0", "id": "GHSA-rvv3-g6hj-g44x", - "modified": "2026-03-16T12:45:41Z", + "modified": "2026-03-16T12:45:44Z", "published": "2026-03-13T20:57:07Z", "aliases": [], - "summary": "AutoMapper Vulnerable to Denial of Service (DoS) via Uncontrolled Recursion", - "details": "### Summary\n\nAutoMapper is vulnerable to a Denial of Service (DoS) attack. When mapping deeply nested object graphs, the library uses recursive method calls without enforcing a default maximum depth limit. This allows an attacker to provide a specially crafted object graph that exhausts the thread's stack memory, triggering a `StackOverflowException` and causing the entire application process to terminate.\n\n### Description\n\nThe vulnerability exists in the core mapping engine. When a source object contains a property of the same type (or a type that eventually points back to itself), AutoMapper recursively attempts to map each level.\n\nBecause there is no default limit on how many levels deep this recursion can go, a sufficiently nested object (approximately 25,000+ levels in standard .NET environments) will exceed the stack size. Since `StackOverflowException` cannot be caught in modern .NET runtimes, the application cannot recover and will crash immediately.\n\n### Impact\n\n* **Availability:** An attacker can crash the application server, leading to a complete Denial of Service.\n* **Process Termination:** Unlike standard exceptions, this terminates the entire process, not just the individual request thread.\n\n### Proof of Concept (PoC)\n\nThe following C# code demonstrates the crash by creating a nested \"Circular\" object graph and attempting to map it:\n\n```csharp\nclass Circular { public Circular Self { get; set; } }\n\n// Setup configuration\nvar config = new MapperConfiguration(cfg => {\n cfg.CreateMap();\n});\nvar mapper = config.CreateMapper();\n\n// Create a deeply nested object (28,000+ levels)\nvar root = new Circular();\nvar current = root;\nfor (int i = 0; i < 30000; i++) {\n current.Self = new Circular();\n current = current.Self;\n}\n\n// This call triggers the StackOverflowException and crashes the process\nmapper.Map(root);\n\n```\n\n### Recommended Mitigation\n\n1. **Secure Defaults:** Implement a default `MaxDepth` (e.g., 32 or 64) for all mapping operations.\n2. **Configurable Limit:** Allow users to increase this limit if necessary, but ensure it is enabled by default to protect unsuspecting developers.", + "summary": "GOYSLOP", + "details": "GOYSLOP", "severity": [ { "type": "CVSS_V3", @@ -55,23 +55,11 @@ "references": [ { "type": "WEB", - "url": "https://github.com/LuckyPennySoftware/AutoMapper/security/advisories/GHSA-rvv3-g6hj-g44x" - }, - { - "type": "WEB", - "url": "https://github.com/LuckyPennySoftware/AutoMapper/commit/0afaf1e91648fca1a57512e94dd00a76ee016816" + "url": "https://GOYSLOP.com" }, { "type": "PACKAGE", "url": "https://github.com/LuckyPennySoftware/AutoMapper" - }, - { - "type": "WEB", - "url": "https://github.com/LuckyPennySoftware/AutoMapper/releases/tag/v15.1.1" - }, - { - "type": "WEB", - "url": "https://github.com/LuckyPennySoftware/AutoMapper/releases/tag/v16.1.1" } ], "database_specific": {