[GHSA-rvv3-g6hj-g44x] AutoMapper Vulnerable to Denial of Service (DoS) via Uncontrolled Recursion

advisories/github-reviewed/2026/03/GHSA-rvv3-g6hj-g44x/GHSA-rvv3-g6hj-g44x.json

@@ -1,11 +1,11 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-rvv3-g6hj-g44x",
-  "modified": "2026-03-16T12:45:41Z",
+  "modified": "2026-03-16T12:45:44Z",
   "published": "2026-03-13T20:57:07Z",
   "aliases": [],
-  "summary": "AutoMapper Vulnerable to Denial of Service (DoS) via Uncontrolled Recursion",
-  "details": "### Summary\n\nAutoMapper is vulnerable to a Denial of Service (DoS) attack. When mapping deeply nested object graphs, the library uses recursive method calls without enforcing a default maximum depth limit. This allows an attacker to provide a specially crafted object graph that exhausts the thread's stack memory, triggering a `StackOverflowException` and causing the entire application process to terminate.\n\n### Description\n\nThe vulnerability exists in the core mapping engine. When a source object contains a property of the same type (or a type that eventually points back to itself), AutoMapper recursively attempts to map each level.\n\nBecause there is no default limit on how many levels deep this recursion can go, a sufficiently nested object (approximately 25,000+ levels in standard .NET environments) will exceed the stack size. Since `StackOverflowException` cannot be caught in modern .NET runtimes, the application cannot recover and will crash immediately.\n\n### Impact\n\n* **Availability:** An attacker can crash the application server, leading to a complete Denial of Service.\n* **Process Termination:** Unlike standard exceptions, this terminates the entire process, not just the individual request thread.\n\n### Proof of Concept (PoC)\n\nThe following C# code demonstrates the crash by creating a nested \"Circular\" object graph and attempting to map it:\n\n```csharp\nclass Circular { public Circular Self { get; set; } }\n\n// Setup configuration\nvar config = new MapperConfiguration(cfg => {\n    cfg.CreateMap<Circular, Circular>();\n});\nvar mapper = config.CreateMapper();\n\n// Create a deeply nested object (28,000+ levels)\nvar root = new Circular();\nvar current = root;\nfor (int i = 0; i < 30000; i++) {\n    current.Self = new Circular();\n    current = current.Self;\n}\n\n// This call triggers the StackOverflowException and crashes the process\nmapper.Map<Circular>(root);\n\n```\n\n### Recommended Mitigation\n\n1. **Secure Defaults:** Implement a default `MaxDepth` (e.g., 32 or 64) for all mapping operations.\n2. **Configurable Limit:** Allow users to increase this limit if necessary, but ensure it is enabled by default to protect unsuspecting developers.",
+  "summary": "GOYSLOP",
+  "details": "GOYSLOP",
   "severity": [
     {
       "type": "CVSS_V3",
@@ -55,23 +55,11 @@
   "references": [
     {
       "type": "WEB",
-      "url": "https://github.com/LuckyPennySoftware/AutoMapper/security/advisories/GHSA-rvv3-g6hj-g44x"
-    },
-    {
-      "type": "WEB",
-      "url": "https://github.com/LuckyPennySoftware/AutoMapper/commit/0afaf1e91648fca1a57512e94dd00a76ee016816"
+      "url": "https://GOYSLOP.com"
     },
     {
       "type": "PACKAGE",
       "url": "https://github.com/LuckyPennySoftware/AutoMapper"
-    },
-    {
-      "type": "WEB",
-      "url": "https://github.com/LuckyPennySoftware/AutoMapper/releases/tag/v15.1.1"
-    },
-    {
-      "type": "WEB",
-      "url": "https://github.com/LuckyPennySoftware/AutoMapper/releases/tag/v16.1.1"
     }
   ],
   "database_specific": {