7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

GHSA-rvv3-g6hj-g44x

GHSA-rvv3-g6hj-g44x: AutoMapper Vulnerable to Denial of Service (DoS) via Uncontrolled Recursion

Summary

AutoMapper is vulnerable to a Denial of Service (DoS) attack. When mapping deeply nested object graphs, the library uses recursive method calls without enforcing a default maximum depth limit. This allows an attacker to provide a specially crafted object graph that exhausts the thread's stack memory, triggering a StackOverflowException and causing the entire application process to terminate.

Description

The vulnerability exists in the core mapping engine. When a source object contains a property of the same type (or a type that eventually points back to itself), AutoMapper recursively attempts to map each level.

Because there is no default limit on how many levels deep this recursion can go, a sufficiently nested object (approximately 25,000+ levels in standard .NET environments) will exceed the stack size. Since StackOverflowException cannot be caught in modern .NET runtimes, the application cannot recover and will crash immediately.

Impact

Availability: An attacker can crash the application server, leading to a complete Denial of Service.
Process Termination: Unlike standard exceptions, this terminates the entire process, not just the individual request thread.

Proof of Concept (PoC)

The following C# code demonstrates the crash by creating a nested "Circular" object graph and attempting to map it:

class Circular { public Circular Self { get; set; } }

// Setup configuration
var config = new MapperConfiguration(cfg => {
    cfg.CreateMap<Circular, Circular>();
});
var mapper = config.CreateMapper();

// Create a deeply nested object (28,000+ levels)
var root = new Circular();
var current = root;
for (int i = 0; i < 30000; i++) {
    current.Self = new Circular();
    current = current.Self;
}

// This call triggers the StackOverflowException and crashes the process
mapper.Map<Circular>(root);

Recommended Mitigation

Secure Defaults: Implement a default MaxDepth (e.g., 32 or 64) for all mapping operations.
Configurable Limit: Allow users to increase this limit if necessary, but ensure it is enabled by default to protect unsuspecting developers.

(GitHub Advisory)

Miggo Vulnerability Database

→

GHSA-rvv3-g6hj-g44x

GHSA-rvv3-g6hj-g44x:

7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
AutoMapper	nuget	>= 16.0.0, < 16.1.1	16.1.1
AutoMapper	nuget	< 15.1.1	15.1.1

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a Denial of Service (DoS) in AutoMapper caused by uncontrolled recursion when mapping deeply nested or self-referential object graphs. The root cause is the absence of a default maximum depth limit for these mappings, which allows a specially crafted object to cause a StackOverflowException and terminate the application process.

The analysis of the fixing commit 0afaf1e91648fca1a57512e94dd00a76ee016816 revealed that the core logic flaw was in the AutoMapper.Execution.TypeMapPlanBuilder.CheckForCycles method. This function was responsible for detecting cycles in the mapping configuration. While it correctly identified cycles, it failed to apply a default MaxDepth, which is necessary to prevent infinite recursion during the mapping process. The patch rectifies this by adding logic to set a default MaxDepth of 64 if one isn't already configured by the user.

The vulnerability is triggered at runtime when the user calls the AutoMapper.Mapper.Map method. This method initiates the mapping operation, which, for a cyclic type without a depth limit, would recursively call itself until the stack overflows. Therefore, Mapper.Map is the entry point for the exploit, and CheckForCycles is the function containing the underlying configuration flaw that enables it. Both functions are critical to understanding and identifying the vulnerability in a runtime context.

Vulnerable functions

AutoMapper.Execution.TypeMapPlanBuilder.CheckForCycles

src/AutoMapper/Execution/TypeMapPlanBuilder.cs

This function is responsible for detecting and handling cyclic dependencies in object mappings. The vulnerability stems from the fact that this function, prior to the patch, would detect a cycle and enable reference preservation (`PreserveReferences`) but would not enforce a default recursion depth limit (`MaxDepth`). This allowed the mapping engine to recurse indefinitely when processing a deeply nested object graph, leading to a stack overflow. The patch corrects this by setting a default `MaxDepth` of 64 when a cycle is detected and no limit is already specified.

AutoMapper.Mapper.Map

src/AutoMapper/Mapper.cs

This is the main public method used to perform object-to-object mapping. It serves as the entry point for the vulnerable operation. When a user calls this method with a deeply nested object and a flawed configuration (lacking a `MaxDepth` limit for cyclic types), it initiates the uncontrolled recursive mapping process that ultimately exhausts the stack and crashes the application. A runtime profiler would show this function at the top of the call stack leading to the `StackOverflowException`.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.