Skip to content

Update dependency AutoMapper to v16 [SECURITY]#116

Open
renovate[bot] wants to merge 1 commit intomasterfrom
renovate/nuget-automapper-vulnerability
Open

Update dependency AutoMapper to v16 [SECURITY]#116
renovate[bot] wants to merge 1 commit intomasterfrom
renovate/nuget-automapper-vulnerability

Conversation

@renovate
Copy link
Contributor

@renovate renovate bot commented Mar 14, 2026

This PR contains the following updates:

Package Change Age Confidence
AutoMapper (source) 12.0.1 → 16.1.1 age confidence

GitHub Vulnerability Alerts

GHSA-rvv3-g6hj-g44x

Summary

AutoMapper is vulnerable to a Denial of Service (DoS) attack. When mapping deeply nested object graphs, the library uses recursive method calls without enforcing a default maximum depth limit. This allows an attacker to provide a specially crafted object graph that exhausts the thread's stack memory, triggering a StackOverflowException and causing the entire application process to terminate.

Description

The vulnerability exists in the core mapping engine. When a source object contains a property of the same type (or a type that eventually points back to itself), AutoMapper recursively attempts to map each level.

Because there is no default limit on how many levels deep this recursion can go, a sufficiently nested object (approximately 25,000+ levels in standard .NET environments) will exceed the stack size. Since StackOverflowException cannot be caught in modern .NET runtimes, the application cannot recover and will crash immediately.

Impact

  • Availability: An attacker can crash the application server, leading to a complete Denial of Service.
  • Process Termination: Unlike standard exceptions, this terminates the entire process, not just the individual request thread.

Proof of Concept (PoC)

The following C# code demonstrates the crash by creating a nested "Circular" object graph and attempting to map it:

class Circular { public Circular Self { get; set; } }

// Setup configuration
var config = new MapperConfiguration(cfg => {
    cfg.CreateMap<Circular, Circular>();
});
var mapper = config.CreateMapper();

// Create a deeply nested object (28,000+ levels)
var root = new Circular();
var current = root;
for (int i = 0; i < 30000; i++) {
    current.Self = new Circular();
    current = current.Self;
}

// This call triggers the StackOverflowException and crashes the process
mapper.Map<Circular>(root);

Recommended Mitigation

  1. Secure Defaults: Implement a default MaxDepth (e.g., 32 or 64) for all mapping operations.
  2. Configurable Limit: Allow users to increase this limit if necessary, but ensure it is enabled by default to protect unsuspecting developers.

Release Notes

LuckyPennySoftware/AutoMapper (AutoMapper)

v16.1.1

What's Changed

Security

Fixed an issue where certain cyclic or self-referential object graphs could trigger uncontrolled recursion during mapping, potentially resulting in stack exhaustion and denial of service.

Applications that process untrusted or attacker-controlled object graphs through affected mapping paths may be impacted.

Users should upgrade to this release.

Security advisory: GHSA-rvv3-g6hj-g44x

Thanks to @​bluefossa for responsibly disclosing this issue.

Full Changelog: LuckyPennySoftware/AutoMapper@v16.1.0...v16.1.1

v16.1.0

What's Changed
New Contributors

Full Changelog: LuckyPennySoftware/AutoMapper@v16.0.0...v16.1.0

v16.0.0

What's Changed

Full Changelog: LuckyPennySoftware/AutoMapper@v15.1.0...v16.0.0

v15.1.0

What's Changed

New Contributors

Full Changelog: LuckyPennySoftware/AutoMapper@v15.0.1...v15.1.0

v15.0.1

What's Changed

Full Changelog: LuckyPennySoftware/AutoMapper@v15.0.0...v15.0.1

This release supersedes the 15.0.0 release, reverting behavior and overloads so that the AddAutoMapper overloads separate the "scanning for maps" from the "scanning for dependencies". Unfortunately it's not really possible to combine these two together.

This also fixes a critical bug in #​4545 that does not work with .NET 4.x applications (as intended).

Because of this, the 15.0.0 will be delisted because of the breaking changes there.

v15.0.0

Full Changelog: LuckyPennySoftware/AutoMapper@v14.0.0...v15.0.0

  • Added support for .NET Standard 2.0
  • Requiring license key
  • Moving from MIT license to dual commercial/OSS license

To set your license key:

services.AddAutoMapper(cfg => {
    cfg.LicenseKey = "<License key here>";
});

This also introduced a breaking change with MapperConfiguration requiring an ILoggerFactory for logging purposes:

public MapperConfiguration(MapperConfigurationExpression configurationExpression, ILoggerFactory loggerFactory)

Registering AutoMapper with services.AddAutoMapper will automatically supply this parameter. Otherwise you'll need to supply the logger factory.

You can obtain your license key at AutoMapper.io

v14.0.0

What's Changed
New Contributors

Full Changelog: LuckyPennySoftware/AutoMapper@v13.0.1...v14.0.0

v13.0.1

What's Changed

New Contributors

Full Changelog: LuckyPennySoftware/AutoMapper@v13.0.0...v13.0.1

v13.0.0

What's Changed

New Contributors

Full Changelog: LuckyPennySoftware/AutoMapper@v12.0.1...v13.0.0

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants