AutoMapper
A convention-based object-object mapper.
Activity
- Latest release
- 2mo ago
- Total releases
- 53
- Cadence
- ~3 months
- Last 12 months
- 7
Details
- License
- MIT
- First release
- Sep 07, 2011
| Version | Released | |
|---|---|---|
16.2.0
minor
|
16.2.0
minor
Dependencies (5)
|
|
15.1.3
patch
|
15.1.3
patch
Dependencies (5)
|
|
16.1.1
patch
|
16.1.1
patch
Dependencies (5)
|
|
16.1.0
minor
1 CVE
CVE-2026-32933
GHSA-rvv3-g6hj-g44x
Mar 13, 2026
AutoMapper Vulnerable to Denial of Service (DoS) via Uncontrolled Recursion
7.5
/ 10
High
Network
Low
None
None
Unchanged
None
None
High
SummaryAutoMapper is vulnerable to a Denial of Service (DoS) attack. When mapping deeply nested object graphs, the library uses recursive method calls without enforcing a default maximum depth limit. This allows an attacker to provide a specially crafted object graph that exhausts the thread's stack memory, triggering a DescriptionThe vulnerability exists in the core mapping engine. When a source object contains a property of the same type (or a type that eventually points back to itself), AutoMapper recursively attempts to map each level. Because there is no default limit on how many levels deep this recursion can go, a sufficiently nested object (approximately 25,000+ levels in standard .NET environments) will exceed the stack size. Since Impact
Proof of Concept (PoC)The following C# code demonstrates the crash by creating a nested "Circular" object graph and attempting to map it: Recommended Mitigation
Affected versions
16.0.0
16.1.0
1.1.0.118
1.1.1
1.1.2
10.0.0
10.1.0
10.1.1
11.0.0
11.0.1
12.0.0
12.0.1
+ 217 more Show less
13.0.0
13.0.1
14.0.0
15.0.0
15.0.1
15.1.0
2.0.0
2.1.1
2.1.262
2.1.265
2.1.266
2.1.267
2.2.0
2.2.1
2.2.1-ci10
2.2.1-ci1000
2.2.1-ci11
2.2.1-ci15
2.2.1-ci16
2.2.1-ci17
2.2.1-ci4
2.2.1-ci5
2.2.1-ci6
2.2.1-ci7
2.2.1-ci8
2.2.1-ci9
2.2.1-ci9000
2.2.1-ci9001
2.2.1-ci9002
2.2.1-ci9003
2.2.1-ci9004
2.2.1-ci9005
2.2.1-ci9006
2.2.24-ci
2.2.25-ci
3.0.0
3.0.0-ci1026
3.0.0-ci1028
3.0.0-ci1029
3.0.0-ci1031
3.0.0-ci1032
3.0.0-ci1033
3.0.0-ci1034
3.0.0-ci1035
3.0.0-ci1036
3.0.0-ci1037
3.0.0-ci1038
3.0.0-ci1039
3.0.0-ci1040
3.0.0-ci1041
3.0.0-ci1042
3.0.0-ci1043
3.0.0-ci1053
3.1.0
3.1.0-ci1014
3.1.0-ci1016
3.1.0-ci1017
3.1.0-ci1018
3.1.0-ci1019
3.1.0-ci1020
3.1.0-ci1021
3.1.0-ci1022
3.1.0-ci1023
3.1.0-ci1024
3.1.0-ci1026
3.1.0-ci1027
3.1.0-ci1032
3.1.0-ci1033
3.1.0-ci1034
3.1.0-ci1035
3.1.0-ci1036
3.1.0-ci1037
3.1.0-ci1038
3.1.0-ci1043
3.1.0-ci1044
3.1.0-ci1045
3.1.0-ci1046
3.1.0-ci1047
3.1.0-ci1048
3.1.0-ci1049
3.1.0-ci1050
3.1.0-ci1051
3.1.0-ci1053
3.1.0-ci1056
3.1.0-ci1058
3.1.1
3.1.1-ci1000
3.1.1-ci1003
3.2.0
3.2.0-ci1000
3.2.0-ci1001
3.2.0-ci1002
3.2.0-ci1003
3.2.0-ci1004
3.2.0-ci1005
3.2.0-ci1008
3.2.0-ci1009
3.2.0-ci1010
3.2.0-ci1011
3.2.0-ci1014
3.2.0-ci1015
3.2.0-ci1016
3.2.0-ci1017
3.2.0-ci1021
3.2.0-ci1022
3.2.0-ci1023
3.2.0-ci1024
3.2.0-ci1025
3.2.0-ci1026
3.2.0-ci1027
3.2.0-ci1028
3.2.0-ci1029
3.2.0-ci1030
3.2.0-ci1033
3.2.0-ci1034
3.2.0-ci1035
3.2.0-ci1036
3.2.0-ci1037
3.2.0-ci1038
3.2.0-ci1039
3.2.0-ci1040
3.2.0-ci1041
3.2.0-ci1042
3.2.0-ci1043
3.2.1
3.2.1-ci1000
3.2.1-ci1001
3.2.1-ci1002
3.3.0
3.3.0-ci1000
3.3.0-ci1001
3.3.0-ci1002
3.3.0-ci1003
3.3.0-ci1004
3.3.0-ci1005
3.3.0-ci1006
3.3.0-ci1007
3.3.0-ci1008
3.3.0-ci1009
3.3.0-ci1016
3.3.0-ci1017
3.3.0-ci1018
3.3.0-ci1019
3.3.0-ci1020
3.3.0-ci1021
3.3.0-ci1022
3.3.0-ci1023
3.3.0-ci1024
3.3.0-ci1025
3.3.0-ci1026
3.3.0-ci1027
3.3.0-ci1028
3.3.0-ci1029
3.3.0-ci1030
3.3.0-ci1031
3.3.0-ci1032
3.3.0-ci1033
3.3.1
4.0.0
4.0.0-alpha1
4.0.0-ci1002
4.0.0-ci1004
4.0.0-ci1006
4.0.0-ci1007
4.0.0-ci1014
4.0.0-ci1015
4.0.0-ci1017
4.0.0-ci1018
4.0.0-ci1019
4.0.0-ci1020
4.0.0-ci1021
4.0.0-ci1026
4.0.0-ci1031
4.0.0-ci1032
4.0.0-ci1034
4.0.0-ci1036
4.0.0-ci1038
4.0.0-ci1046
4.0.0-ci1049
4.0.0-ci1050
4.0.0-ci1051
4.0.0-ci1052
4.0.0-ci1053
4.0.0-ci1054
4.0.0-ci1056
4.0.0-ci1057
4.0.0-ci1061
4.0.1
4.0.2
4.0.3
4.0.4
4.1.0
4.1.1
4.2.0
4.2.1
5.0.0
5.0.0-beta-1
5.0.1
5.0.2
5.1.0
5.1.1
5.2.0
6.0.0
6.0.1
6.0.2
6.1.0
6.1.1
6.2.0
6.2.1
6.2.2
7.0.0
7.0.0-alpha-0001
7.0.1
8.0.0
8.1.0
8.1.1
9.0.0
Fixed in
15.1.1
16.1.1
References
Updated Sep 10, 2026 · Source: OSV.dev |
16.1.0
minor
Dependencies (5)
|
|
16.0.0
major
1 CVE
CVE-2026-32933
GHSA-rvv3-g6hj-g44x
Mar 13, 2026
AutoMapper Vulnerable to Denial of Service (DoS) via Uncontrolled Recursion
7.5
/ 10
High
Network
Low
None
None
Unchanged
None
None
High
SummaryAutoMapper is vulnerable to a Denial of Service (DoS) attack. When mapping deeply nested object graphs, the library uses recursive method calls without enforcing a default maximum depth limit. This allows an attacker to provide a specially crafted object graph that exhausts the thread's stack memory, triggering a DescriptionThe vulnerability exists in the core mapping engine. When a source object contains a property of the same type (or a type that eventually points back to itself), AutoMapper recursively attempts to map each level. Because there is no default limit on how many levels deep this recursion can go, a sufficiently nested object (approximately 25,000+ levels in standard .NET environments) will exceed the stack size. Since Impact
Proof of Concept (PoC)The following C# code demonstrates the crash by creating a nested "Circular" object graph and attempting to map it: Recommended Mitigation
Affected versions
16.0.0
16.1.0
1.1.0.118
1.1.1
1.1.2
10.0.0
10.1.0
10.1.1
11.0.0
11.0.1
12.0.0
12.0.1
+ 217 more Show less
13.0.0
13.0.1
14.0.0
15.0.0
15.0.1
15.1.0
2.0.0
2.1.1
2.1.262
2.1.265
2.1.266
2.1.267
2.2.0
2.2.1
2.2.1-ci10
2.2.1-ci1000
2.2.1-ci11
2.2.1-ci15
2.2.1-ci16
2.2.1-ci17
2.2.1-ci4
2.2.1-ci5
2.2.1-ci6
2.2.1-ci7
2.2.1-ci8
2.2.1-ci9
2.2.1-ci9000
2.2.1-ci9001
2.2.1-ci9002
2.2.1-ci9003
2.2.1-ci9004
2.2.1-ci9005
2.2.1-ci9006
2.2.24-ci
2.2.25-ci
3.0.0
3.0.0-ci1026
3.0.0-ci1028
3.0.0-ci1029
3.0.0-ci1031
3.0.0-ci1032
3.0.0-ci1033
3.0.0-ci1034
3.0.0-ci1035
3.0.0-ci1036
3.0.0-ci1037
3.0.0-ci1038
3.0.0-ci1039
3.0.0-ci1040
3.0.0-ci1041
3.0.0-ci1042
3.0.0-ci1043
3.0.0-ci1053
3.1.0
3.1.0-ci1014
3.1.0-ci1016
3.1.0-ci1017
3.1.0-ci1018
3.1.0-ci1019
3.1.0-ci1020
3.1.0-ci1021
3.1.0-ci1022
3.1.0-ci1023
3.1.0-ci1024
3.1.0-ci1026
3.1.0-ci1027
3.1.0-ci1032
3.1.0-ci1033
3.1.0-ci1034
3.1.0-ci1035
3.1.0-ci1036
3.1.0-ci1037
3.1.0-ci1038
3.1.0-ci1043
3.1.0-ci1044
3.1.0-ci1045
3.1.0-ci1046
3.1.0-ci1047
3.1.0-ci1048
3.1.0-ci1049
3.1.0-ci1050
3.1.0-ci1051
3.1.0-ci1053
3.1.0-ci1056
3.1.0-ci1058
3.1.1
3.1.1-ci1000
3.1.1-ci1003
3.2.0
3.2.0-ci1000
3.2.0-ci1001
3.2.0-ci1002
3.2.0-ci1003
3.2.0-ci1004
3.2.0-ci1005
3.2.0-ci1008
3.2.0-ci1009
3.2.0-ci1010
3.2.0-ci1011
3.2.0-ci1014
3.2.0-ci1015
3.2.0-ci1016
3.2.0-ci1017
3.2.0-ci1021
3.2.0-ci1022
3.2.0-ci1023
3.2.0-ci1024
3.2.0-ci1025
3.2.0-ci1026
3.2.0-ci1027
3.2.0-ci1028
3.2.0-ci1029
3.2.0-ci1030
3.2.0-ci1033
3.2.0-ci1034
3.2.0-ci1035
3.2.0-ci1036
3.2.0-ci1037
3.2.0-ci1038
3.2.0-ci1039
3.2.0-ci1040
3.2.0-ci1041
3.2.0-ci1042
3.2.0-ci1043
3.2.1
3.2.1-ci1000
3.2.1-ci1001
3.2.1-ci1002
3.3.0
3.3.0-ci1000
3.3.0-ci1001
3.3.0-ci1002
3.3.0-ci1003
3.3.0-ci1004
3.3.0-ci1005
3.3.0-ci1006
3.3.0-ci1007
3.3.0-ci1008
3.3.0-ci1009
3.3.0-ci1016
3.3.0-ci1017
3.3.0-ci1018
3.3.0-ci1019
3.3.0-ci1020
3.3.0-ci1021
3.3.0-ci1022
3.3.0-ci1023
3.3.0-ci1024
3.3.0-ci1025
3.3.0-ci1026
3.3.0-ci1027
3.3.0-ci1028
3.3.0-ci1029
3.3.0-ci1030
3.3.0-ci1031
3.3.0-ci1032
3.3.0-ci1033
3.3.1
4.0.0
4.0.0-alpha1
4.0.0-ci1002
4.0.0-ci1004
4.0.0-ci1006
4.0.0-ci1007
4.0.0-ci1014
4.0.0-ci1015
4.0.0-ci1017
4.0.0-ci1018
4.0.0-ci1019
4.0.0-ci1020
4.0.0-ci1021
4.0.0-ci1026
4.0.0-ci1031
4.0.0-ci1032
4.0.0-ci1034
4.0.0-ci1036
4.0.0-ci1038
4.0.0-ci1046
4.0.0-ci1049
4.0.0-ci1050
4.0.0-ci1051
4.0.0-ci1052
4.0.0-ci1053
4.0.0-ci1054
4.0.0-ci1056
4.0.0-ci1057
4.0.0-ci1061
4.0.1
4.0.2
4.0.3
4.0.4
4.1.0
4.1.1
4.2.0
4.2.1
5.0.0
5.0.0-beta-1
5.0.1
5.0.2
5.1.0
5.1.1
5.2.0
6.0.0
6.0.1
6.0.2
6.1.0
6.1.1
6.2.0
6.2.1
6.2.2
7.0.0
7.0.0-alpha-0001
7.0.1
8.0.0
8.1.0
8.1.1
9.0.0
Fixed in
15.1.1
16.1.1
References
Updated Sep 10, 2026 · Source: OSV.dev |
16.0.0
major
Dependencies (5)
|
|
16.0.0-beta-1
pre
|
16.0.0-beta-1
pre
Dependencies (5)
|
|
15.1.0
minor
1 CVE
CVE-2026-32933
GHSA-rvv3-g6hj-g44x
Mar 13, 2026
AutoMapper Vulnerable to Denial of Service (DoS) via Uncontrolled Recursion
7.5
/ 10
High
Network
Low
None
None
Unchanged
None
None
High
SummaryAutoMapper is vulnerable to a Denial of Service (DoS) attack. When mapping deeply nested object graphs, the library uses recursive method calls without enforcing a default maximum depth limit. This allows an attacker to provide a specially crafted object graph that exhausts the thread's stack memory, triggering a DescriptionThe vulnerability exists in the core mapping engine. When a source object contains a property of the same type (or a type that eventually points back to itself), AutoMapper recursively attempts to map each level. Because there is no default limit on how many levels deep this recursion can go, a sufficiently nested object (approximately 25,000+ levels in standard .NET environments) will exceed the stack size. Since Impact
Proof of Concept (PoC)The following C# code demonstrates the crash by creating a nested "Circular" object graph and attempting to map it: Recommended Mitigation
Affected versions
16.0.0
16.1.0
1.1.0.118
1.1.1
1.1.2
10.0.0
10.1.0
10.1.1
11.0.0
11.0.1
12.0.0
12.0.1
+ 217 more Show less
13.0.0
13.0.1
14.0.0
15.0.0
15.0.1
15.1.0
2.0.0
2.1.1
2.1.262
2.1.265
2.1.266
2.1.267
2.2.0
2.2.1
2.2.1-ci10
2.2.1-ci1000
2.2.1-ci11
2.2.1-ci15
2.2.1-ci16
2.2.1-ci17
2.2.1-ci4
2.2.1-ci5
2.2.1-ci6
2.2.1-ci7
2.2.1-ci8
2.2.1-ci9
2.2.1-ci9000
2.2.1-ci9001
2.2.1-ci9002
2.2.1-ci9003
2.2.1-ci9004
2.2.1-ci9005
2.2.1-ci9006
2.2.24-ci
2.2.25-ci
3.0.0
3.0.0-ci1026
3.0.0-ci1028
3.0.0-ci1029
3.0.0-ci1031
3.0.0-ci1032
3.0.0-ci1033
3.0.0-ci1034
3.0.0-ci1035
3.0.0-ci1036
3.0.0-ci1037
3.0.0-ci1038
3.0.0-ci1039
3.0.0-ci1040
3.0.0-ci1041
3.0.0-ci1042
3.0.0-ci1043
3.0.0-ci1053
3.1.0
3.1.0-ci1014
3.1.0-ci1016
3.1.0-ci1017
3.1.0-ci1018
3.1.0-ci1019
3.1.0-ci1020
3.1.0-ci1021
3.1.0-ci1022
3.1.0-ci1023
3.1.0-ci1024
3.1.0-ci1026
3.1.0-ci1027
3.1.0-ci1032
3.1.0-ci1033
3.1.0-ci1034
3.1.0-ci1035
3.1.0-ci1036
3.1.0-ci1037
3.1.0-ci1038
3.1.0-ci1043
3.1.0-ci1044
3.1.0-ci1045
3.1.0-ci1046
3.1.0-ci1047
3.1.0-ci1048
3.1.0-ci1049
3.1.0-ci1050
3.1.0-ci1051
3.1.0-ci1053
3.1.0-ci1056
3.1.0-ci1058
3.1.1
3.1.1-ci1000
3.1.1-ci1003
3.2.0
3.2.0-ci1000
3.2.0-ci1001
3.2.0-ci1002
3.2.0-ci1003
3.2.0-ci1004
3.2.0-ci1005
3.2.0-ci1008
3.2.0-ci1009
3.2.0-ci1010
3.2.0-ci1011
3.2.0-ci1014
3.2.0-ci1015
3.2.0-ci1016
3.2.0-ci1017
3.2.0-ci1021
3.2.0-ci1022
3.2.0-ci1023
3.2.0-ci1024
3.2.0-ci1025
3.2.0-ci1026
3.2.0-ci1027
3.2.0-ci1028
3.2.0-ci1029
3.2.0-ci1030
3.2.0-ci1033
3.2.0-ci1034
3.2.0-ci1035
3.2.0-ci1036
3.2.0-ci1037
3.2.0-ci1038
3.2.0-ci1039
3.2.0-ci1040
3.2.0-ci1041
3.2.0-ci1042
3.2.0-ci1043
3.2.1
3.2.1-ci1000
3.2.1-ci1001
3.2.1-ci1002
3.3.0
3.3.0-ci1000
3.3.0-ci1001
3.3.0-ci1002
3.3.0-ci1003
3.3.0-ci1004
3.3.0-ci1005
3.3.0-ci1006
3.3.0-ci1007
3.3.0-ci1008
3.3.0-ci1009
3.3.0-ci1016
3.3.0-ci1017
3.3.0-ci1018
3.3.0-ci1019
3.3.0-ci1020
3.3.0-ci1021
3.3.0-ci1022
3.3.0-ci1023
3.3.0-ci1024
3.3.0-ci1025
3.3.0-ci1026
3.3.0-ci1027
3.3.0-ci1028
3.3.0-ci1029
3.3.0-ci1030
3.3.0-ci1031
3.3.0-ci1032
3.3.0-ci1033
3.3.1
4.0.0
4.0.0-alpha1
4.0.0-ci1002
4.0.0-ci1004
4.0.0-ci1006
4.0.0-ci1007
4.0.0-ci1014
4.0.0-ci1015
4.0.0-ci1017
4.0.0-ci1018
4.0.0-ci1019
4.0.0-ci1020
4.0.0-ci1021
4.0.0-ci1026
4.0.0-ci1031
4.0.0-ci1032
4.0.0-ci1034
4.0.0-ci1036
4.0.0-ci1038
4.0.0-ci1046
4.0.0-ci1049
4.0.0-ci1050
4.0.0-ci1051
4.0.0-ci1052
4.0.0-ci1053
4.0.0-ci1054
4.0.0-ci1056
4.0.0-ci1057
4.0.0-ci1061
4.0.1
4.0.2
4.0.3
4.0.4
4.1.0
4.1.1
4.2.0
4.2.1
5.0.0
5.0.0-beta-1
5.0.1
5.0.2
5.1.0
5.1.1
5.2.0
6.0.0
6.0.1
6.0.2
6.1.0
6.1.1
6.2.0
6.2.1
6.2.2
7.0.0
7.0.0-alpha-0001
7.0.1
8.0.0
8.1.0
8.1.1
9.0.0
Fixed in
15.1.1
16.1.1
References
Updated Sep 10, 2026 · Source: OSV.dev |
15.1.0
minor
Dependencies (5)
|
|
15.0.1
major
1 CVE
CVE-2026-32933
GHSA-rvv3-g6hj-g44x
Mar 13, 2026
AutoMapper Vulnerable to Denial of Service (DoS) via Uncontrolled Recursion
7.5
/ 10
High
Network
Low
None
None
Unchanged
None
None
High
SummaryAutoMapper is vulnerable to a Denial of Service (DoS) attack. When mapping deeply nested object graphs, the library uses recursive method calls without enforcing a default maximum depth limit. This allows an attacker to provide a specially crafted object graph that exhausts the thread's stack memory, triggering a DescriptionThe vulnerability exists in the core mapping engine. When a source object contains a property of the same type (or a type that eventually points back to itself), AutoMapper recursively attempts to map each level. Because there is no default limit on how many levels deep this recursion can go, a sufficiently nested object (approximately 25,000+ levels in standard .NET environments) will exceed the stack size. Since Impact
Proof of Concept (PoC)The following C# code demonstrates the crash by creating a nested "Circular" object graph and attempting to map it: Recommended Mitigation
Affected versions
16.0.0
16.1.0
1.1.0.118
1.1.1
1.1.2
10.0.0
10.1.0
10.1.1
11.0.0
11.0.1
12.0.0
12.0.1
+ 217 more Show less
13.0.0
13.0.1
14.0.0
15.0.0
15.0.1
15.1.0
2.0.0
2.1.1
2.1.262
2.1.265
2.1.266
2.1.267
2.2.0
2.2.1
2.2.1-ci10
2.2.1-ci1000
2.2.1-ci11
2.2.1-ci15
2.2.1-ci16
2.2.1-ci17
2.2.1-ci4
2.2.1-ci5
2.2.1-ci6
2.2.1-ci7
2.2.1-ci8
2.2.1-ci9
2.2.1-ci9000
2.2.1-ci9001
2.2.1-ci9002
2.2.1-ci9003
2.2.1-ci9004
2.2.1-ci9005
2.2.1-ci9006
2.2.24-ci
2.2.25-ci
3.0.0
3.0.0-ci1026
3.0.0-ci1028
3.0.0-ci1029
3.0.0-ci1031
3.0.0-ci1032
3.0.0-ci1033
3.0.0-ci1034
3.0.0-ci1035
3.0.0-ci1036
3.0.0-ci1037
3.0.0-ci1038
3.0.0-ci1039
3.0.0-ci1040
3.0.0-ci1041
3.0.0-ci1042
3.0.0-ci1043
3.0.0-ci1053
3.1.0
3.1.0-ci1014
3.1.0-ci1016
3.1.0-ci1017
3.1.0-ci1018
3.1.0-ci1019
3.1.0-ci1020
3.1.0-ci1021
3.1.0-ci1022
3.1.0-ci1023
3.1.0-ci1024
3.1.0-ci1026
3.1.0-ci1027
3.1.0-ci1032
3.1.0-ci1033
3.1.0-ci1034
3.1.0-ci1035
3.1.0-ci1036
3.1.0-ci1037
3.1.0-ci1038
3.1.0-ci1043
3.1.0-ci1044
3.1.0-ci1045
3.1.0-ci1046
3.1.0-ci1047
3.1.0-ci1048
3.1.0-ci1049
3.1.0-ci1050
3.1.0-ci1051
3.1.0-ci1053
3.1.0-ci1056
3.1.0-ci1058
3.1.1
3.1.1-ci1000
3.1.1-ci1003
3.2.0
3.2.0-ci1000
3.2.0-ci1001
3.2.0-ci1002
3.2.0-ci1003
3.2.0-ci1004
3.2.0-ci1005
3.2.0-ci1008
3.2.0-ci1009
3.2.0-ci1010
3.2.0-ci1011
3.2.0-ci1014
3.2.0-ci1015
3.2.0-ci1016
3.2.0-ci1017
3.2.0-ci1021
3.2.0-ci1022
3.2.0-ci1023
3.2.0-ci1024
3.2.0-ci1025
3.2.0-ci1026
3.2.0-ci1027
3.2.0-ci1028
3.2.0-ci1029
3.2.0-ci1030
3.2.0-ci1033
3.2.0-ci1034
3.2.0-ci1035
3.2.0-ci1036
3.2.0-ci1037
3.2.0-ci1038
3.2.0-ci1039
3.2.0-ci1040
3.2.0-ci1041
3.2.0-ci1042
3.2.0-ci1043
3.2.1
3.2.1-ci1000
3.2.1-ci1001
3.2.1-ci1002
3.3.0
3.3.0-ci1000
3.3.0-ci1001
3.3.0-ci1002
3.3.0-ci1003
3.3.0-ci1004
3.3.0-ci1005
3.3.0-ci1006
3.3.0-ci1007
3.3.0-ci1008
3.3.0-ci1009
3.3.0-ci1016
3.3.0-ci1017
3.3.0-ci1018
3.3.0-ci1019
3.3.0-ci1020
3.3.0-ci1021
3.3.0-ci1022
3.3.0-ci1023
3.3.0-ci1024
3.3.0-ci1025
3.3.0-ci1026
3.3.0-ci1027
3.3.0-ci1028
3.3.0-ci1029
3.3.0-ci1030
3.3.0-ci1031
3.3.0-ci1032
3.3.0-ci1033
3.3.1
4.0.0
4.0.0-alpha1
4.0.0-ci1002
4.0.0-ci1004
4.0.0-ci1006
4.0.0-ci1007
4.0.0-ci1014
4.0.0-ci1015
4.0.0-ci1017
4.0.0-ci1018
4.0.0-ci1019
4.0.0-ci1020
4.0.0-ci1021
4.0.0-ci1026
4.0.0-ci1031
4.0.0-ci1032
4.0.0-ci1034
4.0.0-ci1036
4.0.0-ci1038
4.0.0-ci1046
4.0.0-ci1049
4.0.0-ci1050
4.0.0-ci1051
4.0.0-ci1052
4.0.0-ci1053
4.0.0-ci1054
4.0.0-ci1056
4.0.0-ci1057
4.0.0-ci1061
4.0.1
4.0.2
4.0.3
4.0.4
4.1.0
4.1.1
4.2.0
4.2.1
5.0.0
5.0.0-beta-1
5.0.1
5.0.2
5.1.0
5.1.1
5.2.0
6.0.0
6.0.1
6.0.2
6.1.0
6.1.1
6.2.0
6.2.1
6.2.2
7.0.0
7.0.0-alpha-0001
7.0.1
8.0.0
8.1.0
8.1.1
9.0.0
Fixed in
15.1.1
16.1.1
References
Updated Sep 10, 2026 · Source: OSV.dev |
15.0.1
major
Dependencies (5)
|
|
14.0.0
major
1 CVE
CVE-2026-32933
GHSA-rvv3-g6hj-g44x
Mar 13, 2026
AutoMapper Vulnerable to Denial of Service (DoS) via Uncontrolled Recursion
7.5
/ 10
High
Network
Low
None
None
Unchanged
None
None
High
SummaryAutoMapper is vulnerable to a Denial of Service (DoS) attack. When mapping deeply nested object graphs, the library uses recursive method calls without enforcing a default maximum depth limit. This allows an attacker to provide a specially crafted object graph that exhausts the thread's stack memory, triggering a DescriptionThe vulnerability exists in the core mapping engine. When a source object contains a property of the same type (or a type that eventually points back to itself), AutoMapper recursively attempts to map each level. Because there is no default limit on how many levels deep this recursion can go, a sufficiently nested object (approximately 25,000+ levels in standard .NET environments) will exceed the stack size. Since Impact
Proof of Concept (PoC)The following C# code demonstrates the crash by creating a nested "Circular" object graph and attempting to map it: Recommended Mitigation
Affected versions
16.0.0
16.1.0
1.1.0.118
1.1.1
1.1.2
10.0.0
10.1.0
10.1.1
11.0.0
11.0.1
12.0.0
12.0.1
+ 217 more Show less
13.0.0
13.0.1
14.0.0
15.0.0
15.0.1
15.1.0
2.0.0
2.1.1
2.1.262
2.1.265
2.1.266
2.1.267
2.2.0
2.2.1
2.2.1-ci10
2.2.1-ci1000
2.2.1-ci11
2.2.1-ci15
2.2.1-ci16
2.2.1-ci17
2.2.1-ci4
2.2.1-ci5
2.2.1-ci6
2.2.1-ci7
2.2.1-ci8
2.2.1-ci9
2.2.1-ci9000
2.2.1-ci9001
2.2.1-ci9002
2.2.1-ci9003
2.2.1-ci9004
2.2.1-ci9005
2.2.1-ci9006
2.2.24-ci
2.2.25-ci
3.0.0
3.0.0-ci1026
3.0.0-ci1028
3.0.0-ci1029
3.0.0-ci1031
3.0.0-ci1032
3.0.0-ci1033
3.0.0-ci1034
3.0.0-ci1035
3.0.0-ci1036
3.0.0-ci1037
3.0.0-ci1038
3.0.0-ci1039
3.0.0-ci1040
3.0.0-ci1041
3.0.0-ci1042
3.0.0-ci1043
3.0.0-ci1053
3.1.0
3.1.0-ci1014
3.1.0-ci1016
3.1.0-ci1017
3.1.0-ci1018
3.1.0-ci1019
3.1.0-ci1020
3.1.0-ci1021
3.1.0-ci1022
3.1.0-ci1023
3.1.0-ci1024
3.1.0-ci1026
3.1.0-ci1027
3.1.0-ci1032
3.1.0-ci1033
3.1.0-ci1034
3.1.0-ci1035
3.1.0-ci1036
3.1.0-ci1037
3.1.0-ci1038
3.1.0-ci1043
3.1.0-ci1044
3.1.0-ci1045
3.1.0-ci1046
3.1.0-ci1047
3.1.0-ci1048
3.1.0-ci1049
3.1.0-ci1050
3.1.0-ci1051
3.1.0-ci1053
3.1.0-ci1056
3.1.0-ci1058
3.1.1
3.1.1-ci1000
3.1.1-ci1003
3.2.0
3.2.0-ci1000
3.2.0-ci1001
3.2.0-ci1002
3.2.0-ci1003
3.2.0-ci1004
3.2.0-ci1005
3.2.0-ci1008
3.2.0-ci1009
3.2.0-ci1010
3.2.0-ci1011
3.2.0-ci1014
3.2.0-ci1015
3.2.0-ci1016
3.2.0-ci1017
3.2.0-ci1021
3.2.0-ci1022
3.2.0-ci1023
3.2.0-ci1024
3.2.0-ci1025
3.2.0-ci1026
3.2.0-ci1027
3.2.0-ci1028
3.2.0-ci1029
3.2.0-ci1030
3.2.0-ci1033
3.2.0-ci1034
3.2.0-ci1035
3.2.0-ci1036
3.2.0-ci1037
3.2.0-ci1038
3.2.0-ci1039
3.2.0-ci1040
3.2.0-ci1041
3.2.0-ci1042
3.2.0-ci1043
3.2.1
3.2.1-ci1000
3.2.1-ci1001
3.2.1-ci1002
3.3.0
3.3.0-ci1000
3.3.0-ci1001
3.3.0-ci1002
3.3.0-ci1003
3.3.0-ci1004
3.3.0-ci1005
3.3.0-ci1006
3.3.0-ci1007
3.3.0-ci1008
3.3.0-ci1009
3.3.0-ci1016
3.3.0-ci1017
3.3.0-ci1018
3.3.0-ci1019
3.3.0-ci1020
3.3.0-ci1021
3.3.0-ci1022
3.3.0-ci1023
3.3.0-ci1024
3.3.0-ci1025
3.3.0-ci1026
3.3.0-ci1027
3.3.0-ci1028
3.3.0-ci1029
3.3.0-ci1030
3.3.0-ci1031
3.3.0-ci1032
3.3.0-ci1033
3.3.1
4.0.0
4.0.0-alpha1
4.0.0-ci1002
4.0.0-ci1004
4.0.0-ci1006
4.0.0-ci1007
4.0.0-ci1014
4.0.0-ci1015
4.0.0-ci1017
4.0.0-ci1018
4.0.0-ci1019
4.0.0-ci1020
4.0.0-ci1021
4.0.0-ci1026
4.0.0-ci1031
4.0.0-ci1032
4.0.0-ci1034
4.0.0-ci1036
4.0.0-ci1038
4.0.0-ci1046
4.0.0-ci1049
4.0.0-ci1050
4.0.0-ci1051
4.0.0-ci1052
4.0.0-ci1053
4.0.0-ci1054
4.0.0-ci1056
4.0.0-ci1057
4.0.0-ci1061
4.0.1
4.0.2
4.0.3
4.0.4
4.1.0
4.1.1
4.2.0
4.2.1
5.0.0
5.0.0-beta-1
5.0.1
5.0.2
5.1.0
5.1.1
5.2.0
6.0.0
6.0.1
6.0.2
6.1.0
6.1.1
6.2.0
6.2.1
6.2.2
7.0.0
7.0.0-alpha-0001
7.0.1
8.0.0
8.1.0
8.1.1
9.0.0
Fixed in
15.1.1
16.1.1
References
Updated Sep 10, 2026 · Source: OSV.dev |
14.0.0
major
Dependencies (1)
|
|
13.0.1
major
1 CVE
CVE-2026-32933
GHSA-rvv3-g6hj-g44x
Mar 13, 2026
AutoMapper Vulnerable to Denial of Service (DoS) via Uncontrolled Recursion
7.5
/ 10
High
Network
Low
None
None
Unchanged
None
None
High
SummaryAutoMapper is vulnerable to a Denial of Service (DoS) attack. When mapping deeply nested object graphs, the library uses recursive method calls without enforcing a default maximum depth limit. This allows an attacker to provide a specially crafted object graph that exhausts the thread's stack memory, triggering a DescriptionThe vulnerability exists in the core mapping engine. When a source object contains a property of the same type (or a type that eventually points back to itself), AutoMapper recursively attempts to map each level. Because there is no default limit on how many levels deep this recursion can go, a sufficiently nested object (approximately 25,000+ levels in standard .NET environments) will exceed the stack size. Since Impact
Proof of Concept (PoC)The following C# code demonstrates the crash by creating a nested "Circular" object graph and attempting to map it: Recommended Mitigation
Affected versions
16.0.0
16.1.0
1.1.0.118
1.1.1
1.1.2
10.0.0
10.1.0
10.1.1
11.0.0
11.0.1
12.0.0
12.0.1
+ 217 more Show less
13.0.0
13.0.1
14.0.0
15.0.0
15.0.1
15.1.0
2.0.0
2.1.1
2.1.262
2.1.265
2.1.266
2.1.267
2.2.0
2.2.1
2.2.1-ci10
2.2.1-ci1000
2.2.1-ci11
2.2.1-ci15
2.2.1-ci16
2.2.1-ci17
2.2.1-ci4
2.2.1-ci5
2.2.1-ci6
2.2.1-ci7
2.2.1-ci8
2.2.1-ci9
2.2.1-ci9000
2.2.1-ci9001
2.2.1-ci9002
2.2.1-ci9003
2.2.1-ci9004
2.2.1-ci9005
2.2.1-ci9006
2.2.24-ci
2.2.25-ci
3.0.0
3.0.0-ci1026
3.0.0-ci1028
3.0.0-ci1029
3.0.0-ci1031
3.0.0-ci1032
3.0.0-ci1033
3.0.0-ci1034
3.0.0-ci1035
3.0.0-ci1036
3.0.0-ci1037
3.0.0-ci1038
3.0.0-ci1039
3.0.0-ci1040
3.0.0-ci1041
3.0.0-ci1042
3.0.0-ci1043
3.0.0-ci1053
3.1.0
3.1.0-ci1014
3.1.0-ci1016
3.1.0-ci1017
3.1.0-ci1018
3.1.0-ci1019
3.1.0-ci1020
3.1.0-ci1021
3.1.0-ci1022
3.1.0-ci1023
3.1.0-ci1024
3.1.0-ci1026
3.1.0-ci1027
3.1.0-ci1032
3.1.0-ci1033
3.1.0-ci1034
3.1.0-ci1035
3.1.0-ci1036
3.1.0-ci1037
3.1.0-ci1038
3.1.0-ci1043
3.1.0-ci1044
3.1.0-ci1045
3.1.0-ci1046
3.1.0-ci1047
3.1.0-ci1048
3.1.0-ci1049
3.1.0-ci1050
3.1.0-ci1051
3.1.0-ci1053
3.1.0-ci1056
3.1.0-ci1058
3.1.1
3.1.1-ci1000
3.1.1-ci1003
3.2.0
3.2.0-ci1000
3.2.0-ci1001
3.2.0-ci1002
3.2.0-ci1003
3.2.0-ci1004
3.2.0-ci1005
3.2.0-ci1008
3.2.0-ci1009
3.2.0-ci1010
3.2.0-ci1011
3.2.0-ci1014
3.2.0-ci1015
3.2.0-ci1016
3.2.0-ci1017
3.2.0-ci1021
3.2.0-ci1022
3.2.0-ci1023
3.2.0-ci1024
3.2.0-ci1025
3.2.0-ci1026
3.2.0-ci1027
3.2.0-ci1028
3.2.0-ci1029
3.2.0-ci1030
3.2.0-ci1033
3.2.0-ci1034
3.2.0-ci1035
3.2.0-ci1036
3.2.0-ci1037
3.2.0-ci1038
3.2.0-ci1039
3.2.0-ci1040
3.2.0-ci1041
3.2.0-ci1042
3.2.0-ci1043
3.2.1
3.2.1-ci1000
3.2.1-ci1001
3.2.1-ci1002
3.3.0
3.3.0-ci1000
3.3.0-ci1001
3.3.0-ci1002
3.3.0-ci1003
3.3.0-ci1004
3.3.0-ci1005
3.3.0-ci1006
3.3.0-ci1007
3.3.0-ci1008
3.3.0-ci1009
3.3.0-ci1016
3.3.0-ci1017
3.3.0-ci1018
3.3.0-ci1019
3.3.0-ci1020
3.3.0-ci1021
3.3.0-ci1022
3.3.0-ci1023
3.3.0-ci1024
3.3.0-ci1025
3.3.0-ci1026
3.3.0-ci1027
3.3.0-ci1028
3.3.0-ci1029
3.3.0-ci1030
3.3.0-ci1031
3.3.0-ci1032
3.3.0-ci1033
3.3.1
4.0.0
4.0.0-alpha1
4.0.0-ci1002
4.0.0-ci1004
4.0.0-ci1006
4.0.0-ci1007
4.0.0-ci1014
4.0.0-ci1015
4.0.0-ci1017
4.0.0-ci1018
4.0.0-ci1019
4.0.0-ci1020
4.0.0-ci1021
4.0.0-ci1026
4.0.0-ci1031
4.0.0-ci1032
4.0.0-ci1034
4.0.0-ci1036
4.0.0-ci1038
4.0.0-ci1046
4.0.0-ci1049
4.0.0-ci1050
4.0.0-ci1051
4.0.0-ci1052
4.0.0-ci1053
4.0.0-ci1054
4.0.0-ci1056
4.0.0-ci1057
4.0.0-ci1061
4.0.1
4.0.2
4.0.3
4.0.4
4.1.0
4.1.1
4.2.0
4.2.1
5.0.0
5.0.0-beta-1
5.0.1
5.0.2
5.1.0
5.1.1
5.2.0
6.0.0
6.0.1
6.0.2
6.1.0
6.1.1
6.2.0
6.2.1
6.2.2
7.0.0
7.0.0-alpha-0001
7.0.1
8.0.0
8.1.0
8.1.1
9.0.0
Fixed in
15.1.1
16.1.1
References
Updated Sep 10, 2026 · Source: OSV.dev |
13.0.1
major
Dependencies (1)
|
|
12.0.1
patch
1 CVE
CVE-2026-32933
GHSA-rvv3-g6hj-g44x
Mar 13, 2026
AutoMapper Vulnerable to Denial of Service (DoS) via Uncontrolled Recursion
7.5
/ 10
High
Network
Low
None
None
Unchanged
None
None
High
SummaryAutoMapper is vulnerable to a Denial of Service (DoS) attack. When mapping deeply nested object graphs, the library uses recursive method calls without enforcing a default maximum depth limit. This allows an attacker to provide a specially crafted object graph that exhausts the thread's stack memory, triggering a DescriptionThe vulnerability exists in the core mapping engine. When a source object contains a property of the same type (or a type that eventually points back to itself), AutoMapper recursively attempts to map each level. Because there is no default limit on how many levels deep this recursion can go, a sufficiently nested object (approximately 25,000+ levels in standard .NET environments) will exceed the stack size. Since Impact
Proof of Concept (PoC)The following C# code demonstrates the crash by creating a nested "Circular" object graph and attempting to map it: Recommended Mitigation
Affected versions
16.0.0
16.1.0
1.1.0.118
1.1.1
1.1.2
10.0.0
10.1.0
10.1.1
11.0.0
11.0.1
12.0.0
12.0.1
+ 217 more Show less
13.0.0
13.0.1
14.0.0
15.0.0
15.0.1
15.1.0
2.0.0
2.1.1
2.1.262
2.1.265
2.1.266
2.1.267
2.2.0
2.2.1
2.2.1-ci10
2.2.1-ci1000
2.2.1-ci11
2.2.1-ci15
2.2.1-ci16
2.2.1-ci17
2.2.1-ci4
2.2.1-ci5
2.2.1-ci6
2.2.1-ci7
2.2.1-ci8
2.2.1-ci9
2.2.1-ci9000
2.2.1-ci9001
2.2.1-ci9002
2.2.1-ci9003
2.2.1-ci9004
2.2.1-ci9005
2.2.1-ci9006
2.2.24-ci
2.2.25-ci
3.0.0
3.0.0-ci1026
3.0.0-ci1028
3.0.0-ci1029
3.0.0-ci1031
3.0.0-ci1032
3.0.0-ci1033
3.0.0-ci1034
3.0.0-ci1035
3.0.0-ci1036
3.0.0-ci1037
3.0.0-ci1038
3.0.0-ci1039
3.0.0-ci1040
3.0.0-ci1041
3.0.0-ci1042
3.0.0-ci1043
3.0.0-ci1053
3.1.0
3.1.0-ci1014
3.1.0-ci1016
3.1.0-ci1017
3.1.0-ci1018
3.1.0-ci1019
3.1.0-ci1020
3.1.0-ci1021
3.1.0-ci1022
3.1.0-ci1023
3.1.0-ci1024
3.1.0-ci1026
3.1.0-ci1027
3.1.0-ci1032
3.1.0-ci1033
3.1.0-ci1034
3.1.0-ci1035
3.1.0-ci1036
3.1.0-ci1037
3.1.0-ci1038
3.1.0-ci1043
3.1.0-ci1044
3.1.0-ci1045
3.1.0-ci1046
3.1.0-ci1047
3.1.0-ci1048
3.1.0-ci1049
3.1.0-ci1050
3.1.0-ci1051
3.1.0-ci1053
3.1.0-ci1056
3.1.0-ci1058
3.1.1
3.1.1-ci1000
3.1.1-ci1003
3.2.0
3.2.0-ci1000
3.2.0-ci1001
3.2.0-ci1002
3.2.0-ci1003
3.2.0-ci1004
3.2.0-ci1005
3.2.0-ci1008
3.2.0-ci1009
3.2.0-ci1010
3.2.0-ci1011
3.2.0-ci1014
3.2.0-ci1015
3.2.0-ci1016
3.2.0-ci1017
3.2.0-ci1021
3.2.0-ci1022
3.2.0-ci1023
3.2.0-ci1024
3.2.0-ci1025
3.2.0-ci1026
3.2.0-ci1027
3.2.0-ci1028
3.2.0-ci1029
3.2.0-ci1030
3.2.0-ci1033
3.2.0-ci1034
3.2.0-ci1035
3.2.0-ci1036
3.2.0-ci1037
3.2.0-ci1038
3.2.0-ci1039
3.2.0-ci1040
3.2.0-ci1041
3.2.0-ci1042
3.2.0-ci1043
3.2.1
3.2.1-ci1000
3.2.1-ci1001
3.2.1-ci1002
3.3.0
3.3.0-ci1000
3.3.0-ci1001
3.3.0-ci1002
3.3.0-ci1003
3.3.0-ci1004
3.3.0-ci1005
3.3.0-ci1006
3.3.0-ci1007
3.3.0-ci1008
3.3.0-ci1009
3.3.0-ci1016
3.3.0-ci1017
3.3.0-ci1018
3.3.0-ci1019
3.3.0-ci1020
3.3.0-ci1021
3.3.0-ci1022
3.3.0-ci1023
3.3.0-ci1024
3.3.0-ci1025
3.3.0-ci1026
3.3.0-ci1027
3.3.0-ci1028
3.3.0-ci1029
3.3.0-ci1030
3.3.0-ci1031
3.3.0-ci1032
3.3.0-ci1033
3.3.1
4.0.0
4.0.0-alpha1
4.0.0-ci1002
4.0.0-ci1004
4.0.0-ci1006
4.0.0-ci1007
4.0.0-ci1014
4.0.0-ci1015
4.0.0-ci1017
4.0.0-ci1018
4.0.0-ci1019
4.0.0-ci1020
4.0.0-ci1021
4.0.0-ci1026
4.0.0-ci1031
4.0.0-ci1032
4.0.0-ci1034
4.0.0-ci1036
4.0.0-ci1038
4.0.0-ci1046
4.0.0-ci1049
4.0.0-ci1050
4.0.0-ci1051
4.0.0-ci1052
4.0.0-ci1053
4.0.0-ci1054
4.0.0-ci1056
4.0.0-ci1057
4.0.0-ci1061
4.0.1
4.0.2
4.0.3
4.0.4
4.1.0
4.1.1
4.2.0
4.2.1
5.0.0
5.0.0-beta-1
5.0.1
5.0.2
5.1.0
5.1.1
5.2.0
6.0.0
6.0.1
6.0.2
6.1.0
6.1.1
6.2.0
6.2.1
6.2.2
7.0.0
7.0.0-alpha-0001
7.0.1
8.0.0
8.1.0
8.1.1
9.0.0
Fixed in
15.1.1
16.1.1
References
Updated Sep 10, 2026 · Source: OSV.dev |
12.0.1
patch
Dependencies (1)
|
|
12.0.0
major
1 CVE
CVE-2026-32933
GHSA-rvv3-g6hj-g44x
Mar 13, 2026
AutoMapper Vulnerable to Denial of Service (DoS) via Uncontrolled Recursion
7.5
/ 10
High
Network
Low
None
None
Unchanged
None
None
High
SummaryAutoMapper is vulnerable to a Denial of Service (DoS) attack. When mapping deeply nested object graphs, the library uses recursive method calls without enforcing a default maximum depth limit. This allows an attacker to provide a specially crafted object graph that exhausts the thread's stack memory, triggering a DescriptionThe vulnerability exists in the core mapping engine. When a source object contains a property of the same type (or a type that eventually points back to itself), AutoMapper recursively attempts to map each level. Because there is no default limit on how many levels deep this recursion can go, a sufficiently nested object (approximately 25,000+ levels in standard .NET environments) will exceed the stack size. Since Impact
Proof of Concept (PoC)The following C# code demonstrates the crash by creating a nested "Circular" object graph and attempting to map it: Recommended Mitigation
Affected versions
16.0.0
16.1.0
1.1.0.118
1.1.1
1.1.2
10.0.0
10.1.0
10.1.1
11.0.0
11.0.1
12.0.0
12.0.1
+ 217 more Show less
13.0.0
13.0.1
14.0.0
15.0.0
15.0.1
15.1.0
2.0.0
2.1.1
2.1.262
2.1.265
2.1.266
2.1.267
2.2.0
2.2.1
2.2.1-ci10
2.2.1-ci1000
2.2.1-ci11
2.2.1-ci15
2.2.1-ci16
2.2.1-ci17
2.2.1-ci4
2.2.1-ci5
2.2.1-ci6
2.2.1-ci7
2.2.1-ci8
2.2.1-ci9
2.2.1-ci9000
2.2.1-ci9001
2.2.1-ci9002
2.2.1-ci9003
2.2.1-ci9004
2.2.1-ci9005
2.2.1-ci9006
2.2.24-ci
2.2.25-ci
3.0.0
3.0.0-ci1026
3.0.0-ci1028
3.0.0-ci1029
3.0.0-ci1031
3.0.0-ci1032
3.0.0-ci1033
3.0.0-ci1034
3.0.0-ci1035
3.0.0-ci1036
3.0.0-ci1037
3.0.0-ci1038
3.0.0-ci1039
3.0.0-ci1040
3.0.0-ci1041
3.0.0-ci1042
3.0.0-ci1043
3.0.0-ci1053
3.1.0
3.1.0-ci1014
3.1.0-ci1016
3.1.0-ci1017
3.1.0-ci1018
3.1.0-ci1019
3.1.0-ci1020
3.1.0-ci1021
3.1.0-ci1022
3.1.0-ci1023
3.1.0-ci1024
3.1.0-ci1026
3.1.0-ci1027
3.1.0-ci1032
3.1.0-ci1033
3.1.0-ci1034
3.1.0-ci1035
3.1.0-ci1036
3.1.0-ci1037
3.1.0-ci1038
3.1.0-ci1043
3.1.0-ci1044
3.1.0-ci1045
3.1.0-ci1046
3.1.0-ci1047
3.1.0-ci1048
3.1.0-ci1049
3.1.0-ci1050
3.1.0-ci1051
3.1.0-ci1053
3.1.0-ci1056
3.1.0-ci1058
3.1.1
3.1.1-ci1000
3.1.1-ci1003
3.2.0
3.2.0-ci1000
3.2.0-ci1001
3.2.0-ci1002
3.2.0-ci1003
3.2.0-ci1004
3.2.0-ci1005
3.2.0-ci1008
3.2.0-ci1009
3.2.0-ci1010
3.2.0-ci1011
3.2.0-ci1014
3.2.0-ci1015
3.2.0-ci1016
3.2.0-ci1017
3.2.0-ci1021
3.2.0-ci1022
3.2.0-ci1023
3.2.0-ci1024
3.2.0-ci1025
3.2.0-ci1026
3.2.0-ci1027
3.2.0-ci1028
3.2.0-ci1029
3.2.0-ci1030
3.2.0-ci1033
3.2.0-ci1034
3.2.0-ci1035
3.2.0-ci1036
3.2.0-ci1037
3.2.0-ci1038
3.2.0-ci1039
3.2.0-ci1040
3.2.0-ci1041
3.2.0-ci1042
3.2.0-ci1043
3.2.1
3.2.1-ci1000
3.2.1-ci1001
3.2.1-ci1002
3.3.0
3.3.0-ci1000
3.3.0-ci1001
3.3.0-ci1002
3.3.0-ci1003
3.3.0-ci1004
3.3.0-ci1005
3.3.0-ci1006
3.3.0-ci1007
3.3.0-ci1008
3.3.0-ci1009
3.3.0-ci1016
3.3.0-ci1017
3.3.0-ci1018
3.3.0-ci1019
3.3.0-ci1020
3.3.0-ci1021
3.3.0-ci1022
3.3.0-ci1023
3.3.0-ci1024
3.3.0-ci1025
3.3.0-ci1026
3.3.0-ci1027
3.3.0-ci1028
3.3.0-ci1029
3.3.0-ci1030
3.3.0-ci1031
3.3.0-ci1032
3.3.0-ci1033
3.3.1
4.0.0
4.0.0-alpha1
4.0.0-ci1002
4.0.0-ci1004
4.0.0-ci1006
4.0.0-ci1007
4.0.0-ci1014
4.0.0-ci1015
4.0.0-ci1017
4.0.0-ci1018
4.0.0-ci1019
4.0.0-ci1020
4.0.0-ci1021
4.0.0-ci1026
4.0.0-ci1031
4.0.0-ci1032
4.0.0-ci1034
4.0.0-ci1036
4.0.0-ci1038
4.0.0-ci1046
4.0.0-ci1049
4.0.0-ci1050
4.0.0-ci1051
4.0.0-ci1052
4.0.0-ci1053
4.0.0-ci1054
4.0.0-ci1056
4.0.0-ci1057
4.0.0-ci1061
4.0.1
4.0.2
4.0.3
4.0.4
4.1.0
4.1.1
4.2.0
4.2.1
5.0.0
5.0.0-beta-1
5.0.1
5.0.2
5.1.0
5.1.1
5.2.0
6.0.0
6.0.1
6.0.2
6.1.0
6.1.1
6.2.0
6.2.1
6.2.2
7.0.0
7.0.0-alpha-0001
7.0.1
8.0.0
8.1.0
8.1.1
9.0.0
Fixed in
15.1.1
16.1.1
References
Updated Sep 10, 2026 · Source: OSV.dev |
12.0.0
major
Dependencies (1)
|
|
11.0.1
patch
1 CVE
CVE-2026-32933
GHSA-rvv3-g6hj-g44x
Mar 13, 2026
AutoMapper Vulnerable to Denial of Service (DoS) via Uncontrolled Recursion
7.5
/ 10
High
Network
Low
None
None
Unchanged
None
None
High
SummaryAutoMapper is vulnerable to a Denial of Service (DoS) attack. When mapping deeply nested object graphs, the library uses recursive method calls without enforcing a default maximum depth limit. This allows an attacker to provide a specially crafted object graph that exhausts the thread's stack memory, triggering a DescriptionThe vulnerability exists in the core mapping engine. When a source object contains a property of the same type (or a type that eventually points back to itself), AutoMapper recursively attempts to map each level. Because there is no default limit on how many levels deep this recursion can go, a sufficiently nested object (approximately 25,000+ levels in standard .NET environments) will exceed the stack size. Since Impact
Proof of Concept (PoC)The following C# code demonstrates the crash by creating a nested "Circular" object graph and attempting to map it: Recommended Mitigation
Affected versions
16.0.0
16.1.0
1.1.0.118
1.1.1
1.1.2
10.0.0
10.1.0
10.1.1
11.0.0
11.0.1
12.0.0
12.0.1
+ 217 more Show less
13.0.0
13.0.1
14.0.0
15.0.0
15.0.1
15.1.0
2.0.0
2.1.1
2.1.262
2.1.265
2.1.266
2.1.267
2.2.0
2.2.1
2.2.1-ci10
2.2.1-ci1000
2.2.1-ci11
2.2.1-ci15
2.2.1-ci16
2.2.1-ci17
2.2.1-ci4
2.2.1-ci5
2.2.1-ci6
2.2.1-ci7
2.2.1-ci8
2.2.1-ci9
2.2.1-ci9000
2.2.1-ci9001
2.2.1-ci9002
2.2.1-ci9003
2.2.1-ci9004
2.2.1-ci9005
2.2.1-ci9006
2.2.24-ci
2.2.25-ci
3.0.0
3.0.0-ci1026
3.0.0-ci1028
3.0.0-ci1029
3.0.0-ci1031
3.0.0-ci1032
3.0.0-ci1033
3.0.0-ci1034
3.0.0-ci1035
3.0.0-ci1036
3.0.0-ci1037
3.0.0-ci1038
3.0.0-ci1039
3.0.0-ci1040
3.0.0-ci1041
3.0.0-ci1042
3.0.0-ci1043
3.0.0-ci1053
3.1.0
3.1.0-ci1014
3.1.0-ci1016
3.1.0-ci1017
3.1.0-ci1018
3.1.0-ci1019
3.1.0-ci1020
3.1.0-ci1021
3.1.0-ci1022
3.1.0-ci1023
3.1.0-ci1024
3.1.0-ci1026
3.1.0-ci1027
3.1.0-ci1032
3.1.0-ci1033
3.1.0-ci1034
3.1.0-ci1035
3.1.0-ci1036
3.1.0-ci1037
3.1.0-ci1038
3.1.0-ci1043
3.1.0-ci1044
3.1.0-ci1045
3.1.0-ci1046
3.1.0-ci1047
3.1.0-ci1048
3.1.0-ci1049
3.1.0-ci1050
3.1.0-ci1051
3.1.0-ci1053
3.1.0-ci1056
3.1.0-ci1058
3.1.1
3.1.1-ci1000
3.1.1-ci1003
3.2.0
3.2.0-ci1000
3.2.0-ci1001
3.2.0-ci1002
3.2.0-ci1003
3.2.0-ci1004
3.2.0-ci1005
3.2.0-ci1008
3.2.0-ci1009
3.2.0-ci1010
3.2.0-ci1011
3.2.0-ci1014
3.2.0-ci1015
3.2.0-ci1016
3.2.0-ci1017
3.2.0-ci1021
3.2.0-ci1022
3.2.0-ci1023
3.2.0-ci1024
3.2.0-ci1025
3.2.0-ci1026
3.2.0-ci1027
3.2.0-ci1028
3.2.0-ci1029
3.2.0-ci1030
3.2.0-ci1033
3.2.0-ci1034
3.2.0-ci1035
3.2.0-ci1036
3.2.0-ci1037
3.2.0-ci1038
3.2.0-ci1039
3.2.0-ci1040
3.2.0-ci1041
3.2.0-ci1042
3.2.0-ci1043
3.2.1
3.2.1-ci1000
3.2.1-ci1001
3.2.1-ci1002
3.3.0
3.3.0-ci1000
3.3.0-ci1001
3.3.0-ci1002
3.3.0-ci1003
3.3.0-ci1004
3.3.0-ci1005
3.3.0-ci1006
3.3.0-ci1007
3.3.0-ci1008
3.3.0-ci1009
3.3.0-ci1016
3.3.0-ci1017
3.3.0-ci1018
3.3.0-ci1019
3.3.0-ci1020
3.3.0-ci1021
3.3.0-ci1022
3.3.0-ci1023
3.3.0-ci1024
3.3.0-ci1025
3.3.0-ci1026
3.3.0-ci1027
3.3.0-ci1028
3.3.0-ci1029
3.3.0-ci1030
3.3.0-ci1031
3.3.0-ci1032
3.3.0-ci1033
3.3.1
4.0.0
4.0.0-alpha1
4.0.0-ci1002
4.0.0-ci1004
4.0.0-ci1006
4.0.0-ci1007
4.0.0-ci1014
4.0.0-ci1015
4.0.0-ci1017
4.0.0-ci1018
4.0.0-ci1019
4.0.0-ci1020
4.0.0-ci1021
4.0.0-ci1026
4.0.0-ci1031
4.0.0-ci1032
4.0.0-ci1034
4.0.0-ci1036
4.0.0-ci1038
4.0.0-ci1046
4.0.0-ci1049
4.0.0-ci1050
4.0.0-ci1051
4.0.0-ci1052
4.0.0-ci1053
4.0.0-ci1054
4.0.0-ci1056
4.0.0-ci1057
4.0.0-ci1061
4.0.1
4.0.2
4.0.3
4.0.4
4.1.0
4.1.1
4.2.0
4.2.1
5.0.0
5.0.0-beta-1
5.0.1
5.0.2
5.1.0
5.1.1
5.2.0
6.0.0
6.0.1
6.0.2
6.1.0
6.1.1
6.2.0
6.2.1
6.2.2
7.0.0
7.0.0-alpha-0001
7.0.1
8.0.0
8.1.0
8.1.1
9.0.0
Fixed in
15.1.1
16.1.1
References
Updated Sep 10, 2026 · Source: OSV.dev |
11.0.1
patch
Dependencies (1)
|
|
11.0.0
major
1 CVE
CVE-2026-32933
GHSA-rvv3-g6hj-g44x
Mar 13, 2026
AutoMapper Vulnerable to Denial of Service (DoS) via Uncontrolled Recursion
7.5
/ 10
High
Network
Low
None
None
Unchanged
None
None
High
SummaryAutoMapper is vulnerable to a Denial of Service (DoS) attack. When mapping deeply nested object graphs, the library uses recursive method calls without enforcing a default maximum depth limit. This allows an attacker to provide a specially crafted object graph that exhausts the thread's stack memory, triggering a DescriptionThe vulnerability exists in the core mapping engine. When a source object contains a property of the same type (or a type that eventually points back to itself), AutoMapper recursively attempts to map each level. Because there is no default limit on how many levels deep this recursion can go, a sufficiently nested object (approximately 25,000+ levels in standard .NET environments) will exceed the stack size. Since Impact
Proof of Concept (PoC)The following C# code demonstrates the crash by creating a nested "Circular" object graph and attempting to map it: Recommended Mitigation
Affected versions
16.0.0
16.1.0
1.1.0.118
1.1.1
1.1.2
10.0.0
10.1.0
10.1.1
11.0.0
11.0.1
12.0.0
12.0.1
+ 217 more Show less
13.0.0
13.0.1
14.0.0
15.0.0
15.0.1
15.1.0
2.0.0
2.1.1
2.1.262
2.1.265
2.1.266
2.1.267
2.2.0
2.2.1
2.2.1-ci10
2.2.1-ci1000
2.2.1-ci11
2.2.1-ci15
2.2.1-ci16
2.2.1-ci17
2.2.1-ci4
2.2.1-ci5
2.2.1-ci6
2.2.1-ci7
2.2.1-ci8
2.2.1-ci9
2.2.1-ci9000
2.2.1-ci9001
2.2.1-ci9002
2.2.1-ci9003
2.2.1-ci9004
2.2.1-ci9005
2.2.1-ci9006
2.2.24-ci
2.2.25-ci
3.0.0
3.0.0-ci1026
3.0.0-ci1028
3.0.0-ci1029
3.0.0-ci1031
3.0.0-ci1032
3.0.0-ci1033
3.0.0-ci1034
3.0.0-ci1035
3.0.0-ci1036
3.0.0-ci1037
3.0.0-ci1038
3.0.0-ci1039
3.0.0-ci1040
3.0.0-ci1041
3.0.0-ci1042
3.0.0-ci1043
3.0.0-ci1053
3.1.0
3.1.0-ci1014
3.1.0-ci1016
3.1.0-ci1017
3.1.0-ci1018
3.1.0-ci1019
3.1.0-ci1020
3.1.0-ci1021
3.1.0-ci1022
3.1.0-ci1023
3.1.0-ci1024
3.1.0-ci1026
3.1.0-ci1027
3.1.0-ci1032
3.1.0-ci1033
3.1.0-ci1034
3.1.0-ci1035
3.1.0-ci1036
3.1.0-ci1037
3.1.0-ci1038
3.1.0-ci1043
3.1.0-ci1044
3.1.0-ci1045
3.1.0-ci1046
3.1.0-ci1047
3.1.0-ci1048
3.1.0-ci1049
3.1.0-ci1050
3.1.0-ci1051
3.1.0-ci1053
3.1.0-ci1056
3.1.0-ci1058
3.1.1
3.1.1-ci1000
3.1.1-ci1003
3.2.0
3.2.0-ci1000
3.2.0-ci1001
3.2.0-ci1002
3.2.0-ci1003
3.2.0-ci1004
3.2.0-ci1005
3.2.0-ci1008
3.2.0-ci1009
3.2.0-ci1010
3.2.0-ci1011
3.2.0-ci1014
3.2.0-ci1015
3.2.0-ci1016
3.2.0-ci1017
3.2.0-ci1021
3.2.0-ci1022
3.2.0-ci1023
3.2.0-ci1024
3.2.0-ci1025
3.2.0-ci1026
3.2.0-ci1027
3.2.0-ci1028
3.2.0-ci1029
3.2.0-ci1030
3.2.0-ci1033
3.2.0-ci1034
3.2.0-ci1035
3.2.0-ci1036
3.2.0-ci1037
3.2.0-ci1038
3.2.0-ci1039
3.2.0-ci1040
3.2.0-ci1041
3.2.0-ci1042
3.2.0-ci1043
3.2.1
3.2.1-ci1000
3.2.1-ci1001
3.2.1-ci1002
3.3.0
3.3.0-ci1000
3.3.0-ci1001
3.3.0-ci1002
3.3.0-ci1003
3.3.0-ci1004
3.3.0-ci1005
3.3.0-ci1006
3.3.0-ci1007
3.3.0-ci1008
3.3.0-ci1009
3.3.0-ci1016
3.3.0-ci1017
3.3.0-ci1018
3.3.0-ci1019
3.3.0-ci1020
3.3.0-ci1021
3.3.0-ci1022
3.3.0-ci1023
3.3.0-ci1024
3.3.0-ci1025
3.3.0-ci1026
3.3.0-ci1027
3.3.0-ci1028
3.3.0-ci1029
3.3.0-ci1030
3.3.0-ci1031
3.3.0-ci1032
3.3.0-ci1033
3.3.1
4.0.0
4.0.0-alpha1
4.0.0-ci1002
4.0.0-ci1004
4.0.0-ci1006
4.0.0-ci1007
4.0.0-ci1014
4.0.0-ci1015
4.0.0-ci1017
4.0.0-ci1018
4.0.0-ci1019
4.0.0-ci1020
4.0.0-ci1021
4.0.0-ci1026
4.0.0-ci1031
4.0.0-ci1032
4.0.0-ci1034
4.0.0-ci1036
4.0.0-ci1038
4.0.0-ci1046
4.0.0-ci1049
4.0.0-ci1050
4.0.0-ci1051
4.0.0-ci1052
4.0.0-ci1053
4.0.0-ci1054
4.0.0-ci1056
4.0.0-ci1057
4.0.0-ci1061
4.0.1
4.0.2
4.0.3
4.0.4
4.1.0
4.1.1
4.2.0
4.2.1
5.0.0
5.0.0-beta-1
5.0.1
5.0.2
5.1.0
5.1.1
5.2.0
6.0.0
6.0.1
6.0.2
6.1.0
6.1.1
6.2.0
6.2.1
6.2.2
7.0.0
7.0.0-alpha-0001
7.0.1
8.0.0
8.1.0
8.1.1
9.0.0
Fixed in
15.1.1
16.1.1
References
Updated Sep 10, 2026 · Source: OSV.dev |
11.0.0
major
Dependencies (1)
|
|
10.1.1
minor
1 CVE
CVE-2026-32933
GHSA-rvv3-g6hj-g44x
Mar 13, 2026
AutoMapper Vulnerable to Denial of Service (DoS) via Uncontrolled Recursion
7.5
/ 10
High
Network
Low
None
None
Unchanged
None
None
High
SummaryAutoMapper is vulnerable to a Denial of Service (DoS) attack. When mapping deeply nested object graphs, the library uses recursive method calls without enforcing a default maximum depth limit. This allows an attacker to provide a specially crafted object graph that exhausts the thread's stack memory, triggering a DescriptionThe vulnerability exists in the core mapping engine. When a source object contains a property of the same type (or a type that eventually points back to itself), AutoMapper recursively attempts to map each level. Because there is no default limit on how many levels deep this recursion can go, a sufficiently nested object (approximately 25,000+ levels in standard .NET environments) will exceed the stack size. Since Impact
Proof of Concept (PoC)The following C# code demonstrates the crash by creating a nested "Circular" object graph and attempting to map it: Recommended Mitigation
Affected versions
16.0.0
16.1.0
1.1.0.118
1.1.1
1.1.2
10.0.0
10.1.0
10.1.1
11.0.0
11.0.1
12.0.0
12.0.1
+ 217 more Show less
13.0.0
13.0.1
14.0.0
15.0.0
15.0.1
15.1.0
2.0.0
2.1.1
2.1.262
2.1.265
2.1.266
2.1.267
2.2.0
2.2.1
2.2.1-ci10
2.2.1-ci1000
2.2.1-ci11
2.2.1-ci15
2.2.1-ci16
2.2.1-ci17
2.2.1-ci4
2.2.1-ci5
2.2.1-ci6
2.2.1-ci7
2.2.1-ci8
2.2.1-ci9
2.2.1-ci9000
2.2.1-ci9001
2.2.1-ci9002
2.2.1-ci9003
2.2.1-ci9004
2.2.1-ci9005
2.2.1-ci9006
2.2.24-ci
2.2.25-ci
3.0.0
3.0.0-ci1026
3.0.0-ci1028
3.0.0-ci1029
3.0.0-ci1031
3.0.0-ci1032
3.0.0-ci1033
3.0.0-ci1034
3.0.0-ci1035
3.0.0-ci1036
3.0.0-ci1037
3.0.0-ci1038
3.0.0-ci1039
3.0.0-ci1040
3.0.0-ci1041
3.0.0-ci1042
3.0.0-ci1043
3.0.0-ci1053
3.1.0
3.1.0-ci1014
3.1.0-ci1016
3.1.0-ci1017
3.1.0-ci1018
3.1.0-ci1019
3.1.0-ci1020
3.1.0-ci1021
3.1.0-ci1022
3.1.0-ci1023
3.1.0-ci1024
3.1.0-ci1026
3.1.0-ci1027
3.1.0-ci1032
3.1.0-ci1033
3.1.0-ci1034
3.1.0-ci1035
3.1.0-ci1036
3.1.0-ci1037
3.1.0-ci1038
3.1.0-ci1043
3.1.0-ci1044
3.1.0-ci1045
3.1.0-ci1046
3.1.0-ci1047
3.1.0-ci1048
3.1.0-ci1049
3.1.0-ci1050
3.1.0-ci1051
3.1.0-ci1053
3.1.0-ci1056
3.1.0-ci1058
3.1.1
3.1.1-ci1000
3.1.1-ci1003
3.2.0
3.2.0-ci1000
3.2.0-ci1001
3.2.0-ci1002
3.2.0-ci1003
3.2.0-ci1004
3.2.0-ci1005
3.2.0-ci1008
3.2.0-ci1009
3.2.0-ci1010
3.2.0-ci1011
3.2.0-ci1014
3.2.0-ci1015
3.2.0-ci1016
3.2.0-ci1017
3.2.0-ci1021
3.2.0-ci1022
3.2.0-ci1023
3.2.0-ci1024
3.2.0-ci1025
3.2.0-ci1026
3.2.0-ci1027
3.2.0-ci1028
3.2.0-ci1029
3.2.0-ci1030
3.2.0-ci1033
3.2.0-ci1034
3.2.0-ci1035
3.2.0-ci1036
3.2.0-ci1037
3.2.0-ci1038
3.2.0-ci1039
3.2.0-ci1040
3.2.0-ci1041
3.2.0-ci1042
3.2.0-ci1043
3.2.1
3.2.1-ci1000
3.2.1-ci1001
3.2.1-ci1002
3.3.0
3.3.0-ci1000
3.3.0-ci1001
3.3.0-ci1002
3.3.0-ci1003
3.3.0-ci1004
3.3.0-ci1005
3.3.0-ci1006
3.3.0-ci1007
3.3.0-ci1008
3.3.0-ci1009
3.3.0-ci1016
3.3.0-ci1017
3.3.0-ci1018
3.3.0-ci1019
3.3.0-ci1020
3.3.0-ci1021
3.3.0-ci1022
3.3.0-ci1023
3.3.0-ci1024
3.3.0-ci1025
3.3.0-ci1026
3.3.0-ci1027
3.3.0-ci1028
3.3.0-ci1029
3.3.0-ci1030
3.3.0-ci1031
3.3.0-ci1032
3.3.0-ci1033
3.3.1
4.0.0
4.0.0-alpha1
4.0.0-ci1002
4.0.0-ci1004
4.0.0-ci1006
4.0.0-ci1007
4.0.0-ci1014
4.0.0-ci1015
4.0.0-ci1017
4.0.0-ci1018
4.0.0-ci1019
4.0.0-ci1020
4.0.0-ci1021
4.0.0-ci1026
4.0.0-ci1031
4.0.0-ci1032
4.0.0-ci1034
4.0.0-ci1036
4.0.0-ci1038
4.0.0-ci1046
4.0.0-ci1049
4.0.0-ci1050
4.0.0-ci1051
4.0.0-ci1052
4.0.0-ci1053
4.0.0-ci1054
4.0.0-ci1056
4.0.0-ci1057
4.0.0-ci1061
4.0.1
4.0.2
4.0.3
4.0.4
4.1.0
4.1.1
4.2.0
4.2.1
5.0.0
5.0.0-beta-1
5.0.1
5.0.2
5.1.0
5.1.1
5.2.0
6.0.0
6.0.1
6.0.2
6.1.0
6.1.1
6.2.0
6.2.1
6.2.2
7.0.0
7.0.0-alpha-0001
7.0.1
8.0.0
8.1.0
8.1.1
9.0.0
Fixed in
15.1.1
16.1.1
References
Updated Sep 10, 2026 · Source: OSV.dev |
10.1.1
minor
Dependencies (2)
|
|
10.0.0
major
1 CVE
CVE-2026-32933
GHSA-rvv3-g6hj-g44x
Mar 13, 2026
AutoMapper Vulnerable to Denial of Service (DoS) via Uncontrolled Recursion
7.5
/ 10
High
Network
Low
None
None
Unchanged
None
None
High
SummaryAutoMapper is vulnerable to a Denial of Service (DoS) attack. When mapping deeply nested object graphs, the library uses recursive method calls without enforcing a default maximum depth limit. This allows an attacker to provide a specially crafted object graph that exhausts the thread's stack memory, triggering a DescriptionThe vulnerability exists in the core mapping engine. When a source object contains a property of the same type (or a type that eventually points back to itself), AutoMapper recursively attempts to map each level. Because there is no default limit on how many levels deep this recursion can go, a sufficiently nested object (approximately 25,000+ levels in standard .NET environments) will exceed the stack size. Since Impact
Proof of Concept (PoC)The following C# code demonstrates the crash by creating a nested "Circular" object graph and attempting to map it: Recommended Mitigation
Affected versions
16.0.0
16.1.0
1.1.0.118
1.1.1
1.1.2
10.0.0
10.1.0
10.1.1
11.0.0
11.0.1
12.0.0
12.0.1
+ 217 more Show less
13.0.0
13.0.1
14.0.0
15.0.0
15.0.1
15.1.0
2.0.0
2.1.1
2.1.262
2.1.265
2.1.266
2.1.267
2.2.0
2.2.1
2.2.1-ci10
2.2.1-ci1000
2.2.1-ci11
2.2.1-ci15
2.2.1-ci16
2.2.1-ci17
2.2.1-ci4
2.2.1-ci5
2.2.1-ci6
2.2.1-ci7
2.2.1-ci8
2.2.1-ci9
2.2.1-ci9000
2.2.1-ci9001
2.2.1-ci9002
2.2.1-ci9003
2.2.1-ci9004
2.2.1-ci9005
2.2.1-ci9006
2.2.24-ci
2.2.25-ci
3.0.0
3.0.0-ci1026
3.0.0-ci1028
3.0.0-ci1029
3.0.0-ci1031
3.0.0-ci1032
3.0.0-ci1033
3.0.0-ci1034
3.0.0-ci1035
3.0.0-ci1036
3.0.0-ci1037
3.0.0-ci1038
3.0.0-ci1039
3.0.0-ci1040
3.0.0-ci1041
3.0.0-ci1042
3.0.0-ci1043
3.0.0-ci1053
3.1.0
3.1.0-ci1014
3.1.0-ci1016
3.1.0-ci1017
3.1.0-ci1018
3.1.0-ci1019
3.1.0-ci1020
3.1.0-ci1021
3.1.0-ci1022
3.1.0-ci1023
3.1.0-ci1024
3.1.0-ci1026
3.1.0-ci1027
3.1.0-ci1032
3.1.0-ci1033
3.1.0-ci1034
3.1.0-ci1035
3.1.0-ci1036
3.1.0-ci1037
3.1.0-ci1038
3.1.0-ci1043
3.1.0-ci1044
3.1.0-ci1045
3.1.0-ci1046
3.1.0-ci1047
3.1.0-ci1048
3.1.0-ci1049
3.1.0-ci1050
3.1.0-ci1051
3.1.0-ci1053
3.1.0-ci1056
3.1.0-ci1058
3.1.1
3.1.1-ci1000
3.1.1-ci1003
3.2.0
3.2.0-ci1000
3.2.0-ci1001
3.2.0-ci1002
3.2.0-ci1003
3.2.0-ci1004
3.2.0-ci1005
3.2.0-ci1008
3.2.0-ci1009
3.2.0-ci1010
3.2.0-ci1011
3.2.0-ci1014
3.2.0-ci1015
3.2.0-ci1016
3.2.0-ci1017
3.2.0-ci1021
3.2.0-ci1022
3.2.0-ci1023
3.2.0-ci1024
3.2.0-ci1025
3.2.0-ci1026
3.2.0-ci1027
3.2.0-ci1028
3.2.0-ci1029
3.2.0-ci1030
3.2.0-ci1033
3.2.0-ci1034
3.2.0-ci1035
3.2.0-ci1036
3.2.0-ci1037
3.2.0-ci1038
3.2.0-ci1039
3.2.0-ci1040
3.2.0-ci1041
3.2.0-ci1042
3.2.0-ci1043
3.2.1
3.2.1-ci1000
3.2.1-ci1001
3.2.1-ci1002
3.3.0
3.3.0-ci1000
3.3.0-ci1001
3.3.0-ci1002
3.3.0-ci1003
3.3.0-ci1004
3.3.0-ci1005
3.3.0-ci1006
3.3.0-ci1007
3.3.0-ci1008
3.3.0-ci1009
3.3.0-ci1016
3.3.0-ci1017
3.3.0-ci1018
3.3.0-ci1019
3.3.0-ci1020
3.3.0-ci1021
3.3.0-ci1022
3.3.0-ci1023
3.3.0-ci1024
3.3.0-ci1025
3.3.0-ci1026
3.3.0-ci1027
3.3.0-ci1028
3.3.0-ci1029
3.3.0-ci1030
3.3.0-ci1031
3.3.0-ci1032
3.3.0-ci1033
3.3.1
4.0.0
4.0.0-alpha1
4.0.0-ci1002
4.0.0-ci1004
4.0.0-ci1006
4.0.0-ci1007
4.0.0-ci1014
4.0.0-ci1015
4.0.0-ci1017
4.0.0-ci1018
4.0.0-ci1019
4.0.0-ci1020
4.0.0-ci1021
4.0.0-ci1026
4.0.0-ci1031
4.0.0-ci1032
4.0.0-ci1034
4.0.0-ci1036
4.0.0-ci1038
4.0.0-ci1046
4.0.0-ci1049
4.0.0-ci1050
4.0.0-ci1051
4.0.0-ci1052
4.0.0-ci1053
4.0.0-ci1054
4.0.0-ci1056
4.0.0-ci1057
4.0.0-ci1061
4.0.1
4.0.2
4.0.3
4.0.4
4.1.0
4.1.1
4.2.0
4.2.1
5.0.0
5.0.0-beta-1
5.0.1
5.0.2
5.1.0
5.1.1
5.2.0
6.0.0
6.0.1
6.0.2
6.1.0
6.1.1
6.2.0
6.2.1
6.2.2
7.0.0
7.0.0-alpha-0001
7.0.1
8.0.0
8.1.0
8.1.1
9.0.0
Fixed in
15.1.1
16.1.1
References
Updated Sep 10, 2026 · Source: OSV.dev |
10.0.0
major
Dependencies (2)
|
|
9.0.0
major
1 CVE
CVE-2026-32933
GHSA-rvv3-g6hj-g44x
Mar 13, 2026
AutoMapper Vulnerable to Denial of Service (DoS) via Uncontrolled Recursion
7.5
/ 10
High
Network
Low
None
None
Unchanged
None
None
High
SummaryAutoMapper is vulnerable to a Denial of Service (DoS) attack. When mapping deeply nested object graphs, the library uses recursive method calls without enforcing a default maximum depth limit. This allows an attacker to provide a specially crafted object graph that exhausts the thread's stack memory, triggering a DescriptionThe vulnerability exists in the core mapping engine. When a source object contains a property of the same type (or a type that eventually points back to itself), AutoMapper recursively attempts to map each level. Because there is no default limit on how many levels deep this recursion can go, a sufficiently nested object (approximately 25,000+ levels in standard .NET environments) will exceed the stack size. Since Impact
Proof of Concept (PoC)The following C# code demonstrates the crash by creating a nested "Circular" object graph and attempting to map it: Recommended Mitigation
Affected versions
16.0.0
16.1.0
1.1.0.118
1.1.1
1.1.2
10.0.0
10.1.0
10.1.1
11.0.0
11.0.1
12.0.0
12.0.1
+ 217 more Show less
13.0.0
13.0.1
14.0.0
15.0.0
15.0.1
15.1.0
2.0.0
2.1.1
2.1.262
2.1.265
2.1.266
2.1.267
2.2.0
2.2.1
2.2.1-ci10
2.2.1-ci1000
2.2.1-ci11
2.2.1-ci15
2.2.1-ci16
2.2.1-ci17
2.2.1-ci4
2.2.1-ci5
2.2.1-ci6
2.2.1-ci7
2.2.1-ci8
2.2.1-ci9
2.2.1-ci9000
2.2.1-ci9001
2.2.1-ci9002
2.2.1-ci9003
2.2.1-ci9004
2.2.1-ci9005
2.2.1-ci9006
2.2.24-ci
2.2.25-ci
3.0.0
3.0.0-ci1026
3.0.0-ci1028
3.0.0-ci1029
3.0.0-ci1031
3.0.0-ci1032
3.0.0-ci1033
3.0.0-ci1034
3.0.0-ci1035
3.0.0-ci1036
3.0.0-ci1037
3.0.0-ci1038
3.0.0-ci1039
3.0.0-ci1040
3.0.0-ci1041
3.0.0-ci1042
3.0.0-ci1043
3.0.0-ci1053
3.1.0
3.1.0-ci1014
3.1.0-ci1016
3.1.0-ci1017
3.1.0-ci1018
3.1.0-ci1019
3.1.0-ci1020
3.1.0-ci1021
3.1.0-ci1022
3.1.0-ci1023
3.1.0-ci1024
3.1.0-ci1026
3.1.0-ci1027
3.1.0-ci1032
3.1.0-ci1033
3.1.0-ci1034
3.1.0-ci1035
3.1.0-ci1036
3.1.0-ci1037
3.1.0-ci1038
3.1.0-ci1043
3.1.0-ci1044
3.1.0-ci1045
3.1.0-ci1046
3.1.0-ci1047
3.1.0-ci1048
3.1.0-ci1049
3.1.0-ci1050
3.1.0-ci1051
3.1.0-ci1053
3.1.0-ci1056
3.1.0-ci1058
3.1.1
3.1.1-ci1000
3.1.1-ci1003
3.2.0
3.2.0-ci1000
3.2.0-ci1001
3.2.0-ci1002
3.2.0-ci1003
3.2.0-ci1004
3.2.0-ci1005
3.2.0-ci1008
3.2.0-ci1009
3.2.0-ci1010
3.2.0-ci1011
3.2.0-ci1014
3.2.0-ci1015
3.2.0-ci1016
3.2.0-ci1017
3.2.0-ci1021
3.2.0-ci1022
3.2.0-ci1023
3.2.0-ci1024
3.2.0-ci1025
3.2.0-ci1026
3.2.0-ci1027
3.2.0-ci1028
3.2.0-ci1029
3.2.0-ci1030
3.2.0-ci1033
3.2.0-ci1034
3.2.0-ci1035
3.2.0-ci1036
3.2.0-ci1037
3.2.0-ci1038
3.2.0-ci1039
3.2.0-ci1040
3.2.0-ci1041
3.2.0-ci1042
3.2.0-ci1043
3.2.1
3.2.1-ci1000
3.2.1-ci1001
3.2.1-ci1002
3.3.0
3.3.0-ci1000
3.3.0-ci1001
3.3.0-ci1002
3.3.0-ci1003
3.3.0-ci1004
3.3.0-ci1005
3.3.0-ci1006
3.3.0-ci1007
3.3.0-ci1008
3.3.0-ci1009
3.3.0-ci1016
3.3.0-ci1017
3.3.0-ci1018
3.3.0-ci1019
3.3.0-ci1020
3.3.0-ci1021
3.3.0-ci1022
3.3.0-ci1023
3.3.0-ci1024
3.3.0-ci1025
3.3.0-ci1026
3.3.0-ci1027
3.3.0-ci1028
3.3.0-ci1029
3.3.0-ci1030
3.3.0-ci1031
3.3.0-ci1032
3.3.0-ci1033
3.3.1
4.0.0
4.0.0-alpha1
4.0.0-ci1002
4.0.0-ci1004
4.0.0-ci1006
4.0.0-ci1007
4.0.0-ci1014
4.0.0-ci1015
4.0.0-ci1017
4.0.0-ci1018
4.0.0-ci1019
4.0.0-ci1020
4.0.0-ci1021
4.0.0-ci1026
4.0.0-ci1031
4.0.0-ci1032
4.0.0-ci1034
4.0.0-ci1036
4.0.0-ci1038
4.0.0-ci1046
4.0.0-ci1049
4.0.0-ci1050
4.0.0-ci1051
4.0.0-ci1052
4.0.0-ci1053
4.0.0-ci1054
4.0.0-ci1056
4.0.0-ci1057
4.0.0-ci1061
4.0.1
4.0.2
4.0.3
4.0.4
4.1.0
4.1.1
4.2.0
4.2.1
5.0.0
5.0.0-beta-1
5.0.1
5.0.2
5.1.0
5.1.1
5.2.0
6.0.0
6.0.1
6.0.2
6.1.0
6.1.1
6.2.0
6.2.1
6.2.2
7.0.0
7.0.0-alpha-0001
7.0.1
8.0.0
8.1.0
8.1.1
9.0.0
Fixed in
15.1.1
16.1.1
References
Updated Sep 10, 2026 · Source: OSV.dev |
9.0.0
major
Dependencies (2)
|
|
8.1.1
patch
1 CVE
CVE-2026-32933
GHSA-rvv3-g6hj-g44x
Mar 13, 2026
AutoMapper Vulnerable to Denial of Service (DoS) via Uncontrolled Recursion
7.5
/ 10
High
Network
Low
None
None
Unchanged
None
None
High
SummaryAutoMapper is vulnerable to a Denial of Service (DoS) attack. When mapping deeply nested object graphs, the library uses recursive method calls without enforcing a default maximum depth limit. This allows an attacker to provide a specially crafted object graph that exhausts the thread's stack memory, triggering a DescriptionThe vulnerability exists in the core mapping engine. When a source object contains a property of the same type (or a type that eventually points back to itself), AutoMapper recursively attempts to map each level. Because there is no default limit on how many levels deep this recursion can go, a sufficiently nested object (approximately 25,000+ levels in standard .NET environments) will exceed the stack size. Since Impact
Proof of Concept (PoC)The following C# code demonstrates the crash by creating a nested "Circular" object graph and attempting to map it: Recommended Mitigation
Affected versions
16.0.0
16.1.0
1.1.0.118
1.1.1
1.1.2
10.0.0
10.1.0
10.1.1
11.0.0
11.0.1
12.0.0
12.0.1
+ 217 more Show less
13.0.0
13.0.1
14.0.0
15.0.0
15.0.1
15.1.0
2.0.0
2.1.1
2.1.262
2.1.265
2.1.266
2.1.267
2.2.0
2.2.1
2.2.1-ci10
2.2.1-ci1000
2.2.1-ci11
2.2.1-ci15
2.2.1-ci16
2.2.1-ci17
2.2.1-ci4
2.2.1-ci5
2.2.1-ci6
2.2.1-ci7
2.2.1-ci8
2.2.1-ci9
2.2.1-ci9000
2.2.1-ci9001
2.2.1-ci9002
2.2.1-ci9003
2.2.1-ci9004
2.2.1-ci9005
2.2.1-ci9006
2.2.24-ci
2.2.25-ci
3.0.0
3.0.0-ci1026
3.0.0-ci1028
3.0.0-ci1029
3.0.0-ci1031
3.0.0-ci1032
3.0.0-ci1033
3.0.0-ci1034
3.0.0-ci1035
3.0.0-ci1036
3.0.0-ci1037
3.0.0-ci1038
3.0.0-ci1039
3.0.0-ci1040
3.0.0-ci1041
3.0.0-ci1042
3.0.0-ci1043
3.0.0-ci1053
3.1.0
3.1.0-ci1014
3.1.0-ci1016
3.1.0-ci1017
3.1.0-ci1018
3.1.0-ci1019
3.1.0-ci1020
3.1.0-ci1021
3.1.0-ci1022
3.1.0-ci1023
3.1.0-ci1024
3.1.0-ci1026
3.1.0-ci1027
3.1.0-ci1032
3.1.0-ci1033
3.1.0-ci1034
3.1.0-ci1035
3.1.0-ci1036
3.1.0-ci1037
3.1.0-ci1038
3.1.0-ci1043
3.1.0-ci1044
3.1.0-ci1045
3.1.0-ci1046
3.1.0-ci1047
3.1.0-ci1048
3.1.0-ci1049
3.1.0-ci1050
3.1.0-ci1051
3.1.0-ci1053
3.1.0-ci1056
3.1.0-ci1058
3.1.1
3.1.1-ci1000
3.1.1-ci1003
3.2.0
3.2.0-ci1000
3.2.0-ci1001
3.2.0-ci1002
3.2.0-ci1003
3.2.0-ci1004
3.2.0-ci1005
3.2.0-ci1008
3.2.0-ci1009
3.2.0-ci1010
3.2.0-ci1011
3.2.0-ci1014
3.2.0-ci1015
3.2.0-ci1016
3.2.0-ci1017
3.2.0-ci1021
3.2.0-ci1022
3.2.0-ci1023
3.2.0-ci1024
3.2.0-ci1025
3.2.0-ci1026
3.2.0-ci1027
3.2.0-ci1028
3.2.0-ci1029
3.2.0-ci1030
3.2.0-ci1033
3.2.0-ci1034
3.2.0-ci1035
3.2.0-ci1036
3.2.0-ci1037
3.2.0-ci1038
3.2.0-ci1039
3.2.0-ci1040
3.2.0-ci1041
3.2.0-ci1042
3.2.0-ci1043
3.2.1
3.2.1-ci1000
3.2.1-ci1001
3.2.1-ci1002
3.3.0
3.3.0-ci1000
3.3.0-ci1001
3.3.0-ci1002
3.3.0-ci1003
3.3.0-ci1004
3.3.0-ci1005
3.3.0-ci1006
3.3.0-ci1007
3.3.0-ci1008
3.3.0-ci1009
3.3.0-ci1016
3.3.0-ci1017
3.3.0-ci1018
3.3.0-ci1019
3.3.0-ci1020
3.3.0-ci1021
3.3.0-ci1022
3.3.0-ci1023
3.3.0-ci1024
3.3.0-ci1025
3.3.0-ci1026
3.3.0-ci1027
3.3.0-ci1028
3.3.0-ci1029
3.3.0-ci1030
3.3.0-ci1031
3.3.0-ci1032
3.3.0-ci1033
3.3.1
4.0.0
4.0.0-alpha1
4.0.0-ci1002
4.0.0-ci1004
4.0.0-ci1006
4.0.0-ci1007
4.0.0-ci1014
4.0.0-ci1015
4.0.0-ci1017
4.0.0-ci1018
4.0.0-ci1019
4.0.0-ci1020
4.0.0-ci1021
4.0.0-ci1026
4.0.0-ci1031
4.0.0-ci1032
4.0.0-ci1034
4.0.0-ci1036
4.0.0-ci1038
4.0.0-ci1046
4.0.0-ci1049
4.0.0-ci1050
4.0.0-ci1051
4.0.0-ci1052
4.0.0-ci1053
4.0.0-ci1054
4.0.0-ci1056
4.0.0-ci1057
4.0.0-ci1061
4.0.1
4.0.2
4.0.3
4.0.4
4.1.0
4.1.1
4.2.0
4.2.1
5.0.0
5.0.0-beta-1
5.0.1
5.0.2
5.1.0
5.1.1
5.2.0
6.0.0
6.0.1
6.0.2
6.1.0
6.1.1
6.2.0
6.2.1
6.2.2
7.0.0
7.0.0-alpha-0001
7.0.1
8.0.0
8.1.0
8.1.1
9.0.0
Fixed in
15.1.1
16.1.1
References
Updated Sep 10, 2026 · Source: OSV.dev |
8.1.1
patch
Dependencies (2)
|
|
8.1.0
minor
1 CVE
CVE-2026-32933
GHSA-rvv3-g6hj-g44x
Mar 13, 2026
AutoMapper Vulnerable to Denial of Service (DoS) via Uncontrolled Recursion
7.5
/ 10
High
Network
Low
None
None
Unchanged
None
None
High
SummaryAutoMapper is vulnerable to a Denial of Service (DoS) attack. When mapping deeply nested object graphs, the library uses recursive method calls without enforcing a default maximum depth limit. This allows an attacker to provide a specially crafted object graph that exhausts the thread's stack memory, triggering a DescriptionThe vulnerability exists in the core mapping engine. When a source object contains a property of the same type (or a type that eventually points back to itself), AutoMapper recursively attempts to map each level. Because there is no default limit on how many levels deep this recursion can go, a sufficiently nested object (approximately 25,000+ levels in standard .NET environments) will exceed the stack size. Since Impact
Proof of Concept (PoC)The following C# code demonstrates the crash by creating a nested "Circular" object graph and attempting to map it: Recommended Mitigation
Affected versions
16.0.0
16.1.0
1.1.0.118
1.1.1
1.1.2
10.0.0
10.1.0
10.1.1
11.0.0
11.0.1
12.0.0
12.0.1
+ 217 more Show less
13.0.0
13.0.1
14.0.0
15.0.0
15.0.1
15.1.0
2.0.0
2.1.1
2.1.262
2.1.265
2.1.266
2.1.267
2.2.0
2.2.1
2.2.1-ci10
2.2.1-ci1000
2.2.1-ci11
2.2.1-ci15
2.2.1-ci16
2.2.1-ci17
2.2.1-ci4
2.2.1-ci5
2.2.1-ci6
2.2.1-ci7
2.2.1-ci8
2.2.1-ci9
2.2.1-ci9000
2.2.1-ci9001
2.2.1-ci9002
2.2.1-ci9003
2.2.1-ci9004
2.2.1-ci9005
2.2.1-ci9006
2.2.24-ci
2.2.25-ci
3.0.0
3.0.0-ci1026
3.0.0-ci1028
3.0.0-ci1029
3.0.0-ci1031
3.0.0-ci1032
3.0.0-ci1033
3.0.0-ci1034
3.0.0-ci1035
3.0.0-ci1036
3.0.0-ci1037
3.0.0-ci1038
3.0.0-ci1039
3.0.0-ci1040
3.0.0-ci1041
3.0.0-ci1042
3.0.0-ci1043
3.0.0-ci1053
3.1.0
3.1.0-ci1014
3.1.0-ci1016
3.1.0-ci1017
3.1.0-ci1018
3.1.0-ci1019
3.1.0-ci1020
3.1.0-ci1021
3.1.0-ci1022
3.1.0-ci1023
3.1.0-ci1024
3.1.0-ci1026
3.1.0-ci1027
3.1.0-ci1032
3.1.0-ci1033
3.1.0-ci1034
3.1.0-ci1035
3.1.0-ci1036
3.1.0-ci1037
3.1.0-ci1038
3.1.0-ci1043
3.1.0-ci1044
3.1.0-ci1045
3.1.0-ci1046
3.1.0-ci1047
3.1.0-ci1048
3.1.0-ci1049
3.1.0-ci1050
3.1.0-ci1051
3.1.0-ci1053
3.1.0-ci1056
3.1.0-ci1058
3.1.1
3.1.1-ci1000
3.1.1-ci1003
3.2.0
3.2.0-ci1000
3.2.0-ci1001
3.2.0-ci1002
3.2.0-ci1003
3.2.0-ci1004
3.2.0-ci1005
3.2.0-ci1008
3.2.0-ci1009
3.2.0-ci1010
3.2.0-ci1011
3.2.0-ci1014
3.2.0-ci1015
3.2.0-ci1016
3.2.0-ci1017
3.2.0-ci1021
3.2.0-ci1022
3.2.0-ci1023
3.2.0-ci1024
3.2.0-ci1025
3.2.0-ci1026
3.2.0-ci1027
3.2.0-ci1028
3.2.0-ci1029
3.2.0-ci1030
3.2.0-ci1033
3.2.0-ci1034
3.2.0-ci1035
3.2.0-ci1036
3.2.0-ci1037
3.2.0-ci1038
3.2.0-ci1039
3.2.0-ci1040
3.2.0-ci1041
3.2.0-ci1042
3.2.0-ci1043
3.2.1
3.2.1-ci1000
3.2.1-ci1001
3.2.1-ci1002
3.3.0
3.3.0-ci1000
3.3.0-ci1001
3.3.0-ci1002
3.3.0-ci1003
3.3.0-ci1004
3.3.0-ci1005
3.3.0-ci1006
3.3.0-ci1007
3.3.0-ci1008
3.3.0-ci1009
3.3.0-ci1016
3.3.0-ci1017
3.3.0-ci1018
3.3.0-ci1019
3.3.0-ci1020
3.3.0-ci1021
3.3.0-ci1022
3.3.0-ci1023
3.3.0-ci1024
3.3.0-ci1025
3.3.0-ci1026
3.3.0-ci1027
3.3.0-ci1028
3.3.0-ci1029
3.3.0-ci1030
3.3.0-ci1031
3.3.0-ci1032
3.3.0-ci1033
3.3.1
4.0.0
4.0.0-alpha1
4.0.0-ci1002
4.0.0-ci1004
4.0.0-ci1006
4.0.0-ci1007
4.0.0-ci1014
4.0.0-ci1015
4.0.0-ci1017
4.0.0-ci1018
4.0.0-ci1019
4.0.0-ci1020
4.0.0-ci1021
4.0.0-ci1026
4.0.0-ci1031
4.0.0-ci1032
4.0.0-ci1034
4.0.0-ci1036
4.0.0-ci1038
4.0.0-ci1046
4.0.0-ci1049
4.0.0-ci1050
4.0.0-ci1051
4.0.0-ci1052
4.0.0-ci1053
4.0.0-ci1054
4.0.0-ci1056
4.0.0-ci1057
4.0.0-ci1061
4.0.1
4.0.2
4.0.3
4.0.4
4.1.0
4.1.1
4.2.0
4.2.1
5.0.0
5.0.0-beta-1
5.0.1
5.0.2
5.1.0
5.1.1
5.2.0
6.0.0
6.0.1
6.0.2
6.1.0
6.1.1
6.2.0
6.2.1
6.2.2
7.0.0
7.0.0-alpha-0001
7.0.1
8.0.0
8.1.0
8.1.1
9.0.0
Fixed in
15.1.1
16.1.1
References
Updated Sep 10, 2026 · Source: OSV.dev |
8.1.0
minor
Dependencies (2)
|
|
8.0.0
major
1 CVE
CVE-2026-32933
GHSA-rvv3-g6hj-g44x
Mar 13, 2026
AutoMapper Vulnerable to Denial of Service (DoS) via Uncontrolled Recursion
7.5
/ 10
High
Network
Low
None
None
Unchanged
None
None
High
SummaryAutoMapper is vulnerable to a Denial of Service (DoS) attack. When mapping deeply nested object graphs, the library uses recursive method calls without enforcing a default maximum depth limit. This allows an attacker to provide a specially crafted object graph that exhausts the thread's stack memory, triggering a DescriptionThe vulnerability exists in the core mapping engine. When a source object contains a property of the same type (or a type that eventually points back to itself), AutoMapper recursively attempts to map each level. Because there is no default limit on how many levels deep this recursion can go, a sufficiently nested object (approximately 25,000+ levels in standard .NET environments) will exceed the stack size. Since Impact
Proof of Concept (PoC)The following C# code demonstrates the crash by creating a nested "Circular" object graph and attempting to map it: Recommended Mitigation
Affected versions
16.0.0
16.1.0
1.1.0.118
1.1.1
1.1.2
10.0.0
10.1.0
10.1.1
11.0.0
11.0.1
12.0.0
12.0.1
+ 217 more Show less
13.0.0
13.0.1
14.0.0
15.0.0
15.0.1
15.1.0
2.0.0
2.1.1
2.1.262
2.1.265
2.1.266
2.1.267
2.2.0
2.2.1
2.2.1-ci10
2.2.1-ci1000
2.2.1-ci11
2.2.1-ci15
2.2.1-ci16
2.2.1-ci17
2.2.1-ci4
2.2.1-ci5
2.2.1-ci6
2.2.1-ci7
2.2.1-ci8
2.2.1-ci9
2.2.1-ci9000
2.2.1-ci9001
2.2.1-ci9002
2.2.1-ci9003
2.2.1-ci9004
2.2.1-ci9005
2.2.1-ci9006
2.2.24-ci
2.2.25-ci
3.0.0
3.0.0-ci1026
3.0.0-ci1028
3.0.0-ci1029
3.0.0-ci1031
3.0.0-ci1032
3.0.0-ci1033
3.0.0-ci1034
3.0.0-ci1035
3.0.0-ci1036
3.0.0-ci1037
3.0.0-ci1038
3.0.0-ci1039
3.0.0-ci1040
3.0.0-ci1041
3.0.0-ci1042
3.0.0-ci1043
3.0.0-ci1053
3.1.0
3.1.0-ci1014
3.1.0-ci1016
3.1.0-ci1017
3.1.0-ci1018
3.1.0-ci1019
3.1.0-ci1020
3.1.0-ci1021
3.1.0-ci1022
3.1.0-ci1023
3.1.0-ci1024
3.1.0-ci1026
3.1.0-ci1027
3.1.0-ci1032
3.1.0-ci1033
3.1.0-ci1034
3.1.0-ci1035
3.1.0-ci1036
3.1.0-ci1037
3.1.0-ci1038
3.1.0-ci1043
3.1.0-ci1044
3.1.0-ci1045
3.1.0-ci1046
3.1.0-ci1047
3.1.0-ci1048
3.1.0-ci1049
3.1.0-ci1050
3.1.0-ci1051
3.1.0-ci1053
3.1.0-ci1056
3.1.0-ci1058
3.1.1
3.1.1-ci1000
3.1.1-ci1003
3.2.0
3.2.0-ci1000
3.2.0-ci1001
3.2.0-ci1002
3.2.0-ci1003
3.2.0-ci1004
3.2.0-ci1005
3.2.0-ci1008
3.2.0-ci1009
3.2.0-ci1010
3.2.0-ci1011
3.2.0-ci1014
3.2.0-ci1015
3.2.0-ci1016
3.2.0-ci1017
3.2.0-ci1021
3.2.0-ci1022
3.2.0-ci1023
3.2.0-ci1024
3.2.0-ci1025
3.2.0-ci1026
3.2.0-ci1027
3.2.0-ci1028
3.2.0-ci1029
3.2.0-ci1030
3.2.0-ci1033
3.2.0-ci1034
3.2.0-ci1035
3.2.0-ci1036
3.2.0-ci1037
3.2.0-ci1038
3.2.0-ci1039
3.2.0-ci1040
3.2.0-ci1041
3.2.0-ci1042
3.2.0-ci1043
3.2.1
3.2.1-ci1000
3.2.1-ci1001
3.2.1-ci1002
3.3.0
3.3.0-ci1000
3.3.0-ci1001
3.3.0-ci1002
3.3.0-ci1003
3.3.0-ci1004
3.3.0-ci1005
3.3.0-ci1006
3.3.0-ci1007
3.3.0-ci1008
3.3.0-ci1009
3.3.0-ci1016
3.3.0-ci1017
3.3.0-ci1018
3.3.0-ci1019
3.3.0-ci1020
3.3.0-ci1021
3.3.0-ci1022
3.3.0-ci1023
3.3.0-ci1024
3.3.0-ci1025
3.3.0-ci1026
3.3.0-ci1027
3.3.0-ci1028
3.3.0-ci1029
3.3.0-ci1030
3.3.0-ci1031
3.3.0-ci1032
3.3.0-ci1033
3.3.1
4.0.0
4.0.0-alpha1
4.0.0-ci1002
4.0.0-ci1004
4.0.0-ci1006
4.0.0-ci1007
4.0.0-ci1014
4.0.0-ci1015
4.0.0-ci1017
4.0.0-ci1018
4.0.0-ci1019
4.0.0-ci1020
4.0.0-ci1021
4.0.0-ci1026
4.0.0-ci1031
4.0.0-ci1032
4.0.0-ci1034
4.0.0-ci1036
4.0.0-ci1038
4.0.0-ci1046
4.0.0-ci1049
4.0.0-ci1050
4.0.0-ci1051
4.0.0-ci1052
4.0.0-ci1053
4.0.0-ci1054
4.0.0-ci1056
4.0.0-ci1057
4.0.0-ci1061
4.0.1
4.0.2
4.0.3
4.0.4
4.1.0
4.1.1
4.2.0
4.2.1
5.0.0
5.0.0-beta-1
5.0.1
5.0.2
5.1.0
5.1.1
5.2.0
6.0.0
6.0.1
6.0.2
6.1.0
6.1.1
6.2.0
6.2.1
6.2.2
7.0.0
7.0.0-alpha-0001
7.0.1
8.0.0
8.1.0
8.1.1
9.0.0
Fixed in
15.1.1
16.1.1
References
Updated Sep 10, 2026 · Source: OSV.dev |
8.0.0
major
Dependencies (3)
|
|
7.0.1
major
1 CVE
CVE-2026-32933
GHSA-rvv3-g6hj-g44x
Mar 13, 2026
AutoMapper Vulnerable to Denial of Service (DoS) via Uncontrolled Recursion
7.5
/ 10
High
Network
Low
None
None
Unchanged
None
None
High
SummaryAutoMapper is vulnerable to a Denial of Service (DoS) attack. When mapping deeply nested object graphs, the library uses recursive method calls without enforcing a default maximum depth limit. This allows an attacker to provide a specially crafted object graph that exhausts the thread's stack memory, triggering a DescriptionThe vulnerability exists in the core mapping engine. When a source object contains a property of the same type (or a type that eventually points back to itself), AutoMapper recursively attempts to map each level. Because there is no default limit on how many levels deep this recursion can go, a sufficiently nested object (approximately 25,000+ levels in standard .NET environments) will exceed the stack size. Since Impact
Proof of Concept (PoC)The following C# code demonstrates the crash by creating a nested "Circular" object graph and attempting to map it: Recommended Mitigation
Affected versions
16.0.0
16.1.0
1.1.0.118
1.1.1
1.1.2
10.0.0
10.1.0
10.1.1
11.0.0
11.0.1
12.0.0
12.0.1
+ 217 more Show less
13.0.0
13.0.1
14.0.0
15.0.0
15.0.1
15.1.0
2.0.0
2.1.1
2.1.262
2.1.265
2.1.266
2.1.267
2.2.0
2.2.1
2.2.1-ci10
2.2.1-ci1000
2.2.1-ci11
2.2.1-ci15
2.2.1-ci16
2.2.1-ci17
2.2.1-ci4
2.2.1-ci5
2.2.1-ci6
2.2.1-ci7
2.2.1-ci8
2.2.1-ci9
2.2.1-ci9000
2.2.1-ci9001
2.2.1-ci9002
2.2.1-ci9003
2.2.1-ci9004
2.2.1-ci9005
2.2.1-ci9006
2.2.24-ci
2.2.25-ci
3.0.0
3.0.0-ci1026
3.0.0-ci1028
3.0.0-ci1029
3.0.0-ci1031
3.0.0-ci1032
3.0.0-ci1033
3.0.0-ci1034
3.0.0-ci1035
3.0.0-ci1036
3.0.0-ci1037
3.0.0-ci1038
3.0.0-ci1039
3.0.0-ci1040
3.0.0-ci1041
3.0.0-ci1042
3.0.0-ci1043
3.0.0-ci1053
3.1.0
3.1.0-ci1014
3.1.0-ci1016
3.1.0-ci1017
3.1.0-ci1018
3.1.0-ci1019
3.1.0-ci1020
3.1.0-ci1021
3.1.0-ci1022
3.1.0-ci1023
3.1.0-ci1024
3.1.0-ci1026
3.1.0-ci1027
3.1.0-ci1032
3.1.0-ci1033
3.1.0-ci1034
3.1.0-ci1035
3.1.0-ci1036
3.1.0-ci1037
3.1.0-ci1038
3.1.0-ci1043
3.1.0-ci1044
3.1.0-ci1045
3.1.0-ci1046
3.1.0-ci1047
3.1.0-ci1048
3.1.0-ci1049
3.1.0-ci1050
3.1.0-ci1051
3.1.0-ci1053
3.1.0-ci1056
3.1.0-ci1058
3.1.1
3.1.1-ci1000
3.1.1-ci1003
3.2.0
3.2.0-ci1000
3.2.0-ci1001
3.2.0-ci1002
3.2.0-ci1003
3.2.0-ci1004
3.2.0-ci1005
3.2.0-ci1008
3.2.0-ci1009
3.2.0-ci1010
3.2.0-ci1011
3.2.0-ci1014
3.2.0-ci1015
3.2.0-ci1016
3.2.0-ci1017
3.2.0-ci1021
3.2.0-ci1022
3.2.0-ci1023
3.2.0-ci1024
3.2.0-ci1025
3.2.0-ci1026
3.2.0-ci1027
3.2.0-ci1028
3.2.0-ci1029
3.2.0-ci1030
3.2.0-ci1033
3.2.0-ci1034
3.2.0-ci1035
3.2.0-ci1036
3.2.0-ci1037
3.2.0-ci1038
3.2.0-ci1039
3.2.0-ci1040
3.2.0-ci1041
3.2.0-ci1042
3.2.0-ci1043
3.2.1
3.2.1-ci1000
3.2.1-ci1001
3.2.1-ci1002
3.3.0
3.3.0-ci1000
3.3.0-ci1001
3.3.0-ci1002
3.3.0-ci1003
3.3.0-ci1004
3.3.0-ci1005
3.3.0-ci1006
3.3.0-ci1007
3.3.0-ci1008
3.3.0-ci1009
3.3.0-ci1016
3.3.0-ci1017
3.3.0-ci1018
3.3.0-ci1019
3.3.0-ci1020
3.3.0-ci1021
3.3.0-ci1022
3.3.0-ci1023
3.3.0-ci1024
3.3.0-ci1025
3.3.0-ci1026
3.3.0-ci1027
3.3.0-ci1028
3.3.0-ci1029
3.3.0-ci1030
3.3.0-ci1031
3.3.0-ci1032
3.3.0-ci1033
3.3.1
4.0.0
4.0.0-alpha1
4.0.0-ci1002
4.0.0-ci1004
4.0.0-ci1006
4.0.0-ci1007
4.0.0-ci1014
4.0.0-ci1015
4.0.0-ci1017
4.0.0-ci1018
4.0.0-ci1019
4.0.0-ci1020
4.0.0-ci1021
4.0.0-ci1026
4.0.0-ci1031
4.0.0-ci1032
4.0.0-ci1034
4.0.0-ci1036
4.0.0-ci1038
4.0.0-ci1046
4.0.0-ci1049
4.0.0-ci1050
4.0.0-ci1051
4.0.0-ci1052
4.0.0-ci1053
4.0.0-ci1054
4.0.0-ci1056
4.0.0-ci1057
4.0.0-ci1061
4.0.1
4.0.2
4.0.3
4.0.4
4.1.0
4.1.1
4.2.0
4.2.1
5.0.0
5.0.0-beta-1
5.0.1
5.0.2
5.1.0
5.1.1
5.2.0
6.0.0
6.0.1
6.0.2
6.1.0
6.1.1
6.2.0
6.2.1
6.2.2
7.0.0
7.0.0-alpha-0001
7.0.1
8.0.0
8.1.0
8.1.1
9.0.0
Fixed in
15.1.1
16.1.1
References
Updated Sep 10, 2026 · Source: OSV.dev |
7.0.1
major
Dependencies (11)
+ 3 more |
|
7.0.0-alpha-0001
pre
1 CVE
CVE-2026-32933
GHSA-rvv3-g6hj-g44x
Mar 13, 2026
AutoMapper Vulnerable to Denial of Service (DoS) via Uncontrolled Recursion
7.5
/ 10
High
Network
Low
None
None
Unchanged
None
None
High
SummaryAutoMapper is vulnerable to a Denial of Service (DoS) attack. When mapping deeply nested object graphs, the library uses recursive method calls without enforcing a default maximum depth limit. This allows an attacker to provide a specially crafted object graph that exhausts the thread's stack memory, triggering a DescriptionThe vulnerability exists in the core mapping engine. When a source object contains a property of the same type (or a type that eventually points back to itself), AutoMapper recursively attempts to map each level. Because there is no default limit on how many levels deep this recursion can go, a sufficiently nested object (approximately 25,000+ levels in standard .NET environments) will exceed the stack size. Since Impact
Proof of Concept (PoC)The following C# code demonstrates the crash by creating a nested "Circular" object graph and attempting to map it: Recommended Mitigation
Affected versions
16.0.0
16.1.0
1.1.0.118
1.1.1
1.1.2
10.0.0
10.1.0
10.1.1
11.0.0
11.0.1
12.0.0
12.0.1
+ 217 more Show less
13.0.0
13.0.1
14.0.0
15.0.0
15.0.1
15.1.0
2.0.0
2.1.1
2.1.262
2.1.265
2.1.266
2.1.267
2.2.0
2.2.1
2.2.1-ci10
2.2.1-ci1000
2.2.1-ci11
2.2.1-ci15
2.2.1-ci16
2.2.1-ci17
2.2.1-ci4
2.2.1-ci5
2.2.1-ci6
2.2.1-ci7
2.2.1-ci8
2.2.1-ci9
2.2.1-ci9000
2.2.1-ci9001
2.2.1-ci9002
2.2.1-ci9003
2.2.1-ci9004
2.2.1-ci9005
2.2.1-ci9006
2.2.24-ci
2.2.25-ci
3.0.0
3.0.0-ci1026
3.0.0-ci1028
3.0.0-ci1029
3.0.0-ci1031
3.0.0-ci1032
3.0.0-ci1033
3.0.0-ci1034
3.0.0-ci1035
3.0.0-ci1036
3.0.0-ci1037
3.0.0-ci1038
3.0.0-ci1039
3.0.0-ci1040
3.0.0-ci1041
3.0.0-ci1042
3.0.0-ci1043
3.0.0-ci1053
3.1.0
3.1.0-ci1014
3.1.0-ci1016
3.1.0-ci1017
3.1.0-ci1018
3.1.0-ci1019
3.1.0-ci1020
3.1.0-ci1021
3.1.0-ci1022
3.1.0-ci1023
3.1.0-ci1024
3.1.0-ci1026
3.1.0-ci1027
3.1.0-ci1032
3.1.0-ci1033
3.1.0-ci1034
3.1.0-ci1035
3.1.0-ci1036
3.1.0-ci1037
3.1.0-ci1038
3.1.0-ci1043
3.1.0-ci1044
3.1.0-ci1045
3.1.0-ci1046
3.1.0-ci1047
3.1.0-ci1048
3.1.0-ci1049
3.1.0-ci1050
3.1.0-ci1051
3.1.0-ci1053
3.1.0-ci1056
3.1.0-ci1058
3.1.1
3.1.1-ci1000
3.1.1-ci1003
3.2.0
3.2.0-ci1000
3.2.0-ci1001
3.2.0-ci1002
3.2.0-ci1003
3.2.0-ci1004
3.2.0-ci1005
3.2.0-ci1008
3.2.0-ci1009
3.2.0-ci1010
3.2.0-ci1011
3.2.0-ci1014
3.2.0-ci1015
3.2.0-ci1016
3.2.0-ci1017
3.2.0-ci1021
3.2.0-ci1022
3.2.0-ci1023
3.2.0-ci1024
3.2.0-ci1025
3.2.0-ci1026
3.2.0-ci1027
3.2.0-ci1028
3.2.0-ci1029
3.2.0-ci1030
3.2.0-ci1033
3.2.0-ci1034
3.2.0-ci1035
3.2.0-ci1036
3.2.0-ci1037
3.2.0-ci1038
3.2.0-ci1039
3.2.0-ci1040
3.2.0-ci1041
3.2.0-ci1042
3.2.0-ci1043
3.2.1
3.2.1-ci1000
3.2.1-ci1001
3.2.1-ci1002
3.3.0
3.3.0-ci1000
3.3.0-ci1001
3.3.0-ci1002
3.3.0-ci1003
3.3.0-ci1004
3.3.0-ci1005
3.3.0-ci1006
3.3.0-ci1007
3.3.0-ci1008
3.3.0-ci1009
3.3.0-ci1016
3.3.0-ci1017
3.3.0-ci1018
3.3.0-ci1019
3.3.0-ci1020
3.3.0-ci1021
3.3.0-ci1022
3.3.0-ci1023
3.3.0-ci1024
3.3.0-ci1025
3.3.0-ci1026
3.3.0-ci1027
3.3.0-ci1028
3.3.0-ci1029
3.3.0-ci1030
3.3.0-ci1031
3.3.0-ci1032
3.3.0-ci1033
3.3.1
4.0.0
4.0.0-alpha1
4.0.0-ci1002
4.0.0-ci1004
4.0.0-ci1006
4.0.0-ci1007
4.0.0-ci1014
4.0.0-ci1015
4.0.0-ci1017
4.0.0-ci1018
4.0.0-ci1019
4.0.0-ci1020
4.0.0-ci1021
4.0.0-ci1026
4.0.0-ci1031
4.0.0-ci1032
4.0.0-ci1034
4.0.0-ci1036
4.0.0-ci1038
4.0.0-ci1046
4.0.0-ci1049
4.0.0-ci1050
4.0.0-ci1051
4.0.0-ci1052
4.0.0-ci1053
4.0.0-ci1054
4.0.0-ci1056
4.0.0-ci1057
4.0.0-ci1061
4.0.1
4.0.2
4.0.3
4.0.4
4.1.0
4.1.1
4.2.0
4.2.1
5.0.0
5.0.0-beta-1
5.0.1
5.0.2
5.1.0
5.1.1
5.2.0
6.0.0
6.0.1
6.0.2
6.1.0
6.1.1
6.2.0
6.2.1
6.2.2
7.0.0
7.0.0-alpha-0001
7.0.1
8.0.0
8.1.0
8.1.1
9.0.0
Fixed in
15.1.1
16.1.1
References
Updated Sep 10, 2026 · Source: OSV.dev |
7.0.0-alpha-0001
pre
Dependencies (11)
+ 3 more |
|
6.2.2
patch
1 CVE
CVE-2026-32933
GHSA-rvv3-g6hj-g44x
Mar 13, 2026
AutoMapper Vulnerable to Denial of Service (DoS) via Uncontrolled Recursion
7.5
/ 10
High
Network
Low
None
None
Unchanged
None
None
High
SummaryAutoMapper is vulnerable to a Denial of Service (DoS) attack. When mapping deeply nested object graphs, the library uses recursive method calls without enforcing a default maximum depth limit. This allows an attacker to provide a specially crafted object graph that exhausts the thread's stack memory, triggering a DescriptionThe vulnerability exists in the core mapping engine. When a source object contains a property of the same type (or a type that eventually points back to itself), AutoMapper recursively attempts to map each level. Because there is no default limit on how many levels deep this recursion can go, a sufficiently nested object (approximately 25,000+ levels in standard .NET environments) will exceed the stack size. Since Impact
Proof of Concept (PoC)The following C# code demonstrates the crash by creating a nested "Circular" object graph and attempting to map it: Recommended Mitigation
Affected versions
16.0.0
16.1.0
1.1.0.118
1.1.1
1.1.2
10.0.0
10.1.0
10.1.1
11.0.0
11.0.1
12.0.0
12.0.1
+ 217 more Show less
13.0.0
13.0.1
14.0.0
15.0.0
15.0.1
15.1.0
2.0.0
2.1.1
2.1.262
2.1.265
2.1.266
2.1.267
2.2.0
2.2.1
2.2.1-ci10
2.2.1-ci1000
2.2.1-ci11
2.2.1-ci15
2.2.1-ci16
2.2.1-ci17
2.2.1-ci4
2.2.1-ci5
2.2.1-ci6
2.2.1-ci7
2.2.1-ci8
2.2.1-ci9
2.2.1-ci9000
2.2.1-ci9001
2.2.1-ci9002
2.2.1-ci9003
2.2.1-ci9004
2.2.1-ci9005
2.2.1-ci9006
2.2.24-ci
2.2.25-ci
3.0.0
3.0.0-ci1026
3.0.0-ci1028
3.0.0-ci1029
3.0.0-ci1031
3.0.0-ci1032
3.0.0-ci1033
3.0.0-ci1034
3.0.0-ci1035
3.0.0-ci1036
3.0.0-ci1037
3.0.0-ci1038
3.0.0-ci1039
3.0.0-ci1040
3.0.0-ci1041
3.0.0-ci1042
3.0.0-ci1043
3.0.0-ci1053
3.1.0
3.1.0-ci1014
3.1.0-ci1016
3.1.0-ci1017
3.1.0-ci1018
3.1.0-ci1019
3.1.0-ci1020
3.1.0-ci1021
3.1.0-ci1022
3.1.0-ci1023
3.1.0-ci1024
3.1.0-ci1026
3.1.0-ci1027
3.1.0-ci1032
3.1.0-ci1033
3.1.0-ci1034
3.1.0-ci1035
3.1.0-ci1036
3.1.0-ci1037
3.1.0-ci1038
3.1.0-ci1043
3.1.0-ci1044
3.1.0-ci1045
3.1.0-ci1046
3.1.0-ci1047
3.1.0-ci1048
3.1.0-ci1049
3.1.0-ci1050
3.1.0-ci1051
3.1.0-ci1053
3.1.0-ci1056
3.1.0-ci1058
3.1.1
3.1.1-ci1000
3.1.1-ci1003
3.2.0
3.2.0-ci1000
3.2.0-ci1001
3.2.0-ci1002
3.2.0-ci1003
3.2.0-ci1004
3.2.0-ci1005
3.2.0-ci1008
3.2.0-ci1009
3.2.0-ci1010
3.2.0-ci1011
3.2.0-ci1014
3.2.0-ci1015
3.2.0-ci1016
3.2.0-ci1017
3.2.0-ci1021
3.2.0-ci1022
3.2.0-ci1023
3.2.0-ci1024
3.2.0-ci1025
3.2.0-ci1026
3.2.0-ci1027
3.2.0-ci1028
3.2.0-ci1029
3.2.0-ci1030
3.2.0-ci1033
3.2.0-ci1034
3.2.0-ci1035
3.2.0-ci1036
3.2.0-ci1037
3.2.0-ci1038
3.2.0-ci1039
3.2.0-ci1040
3.2.0-ci1041
3.2.0-ci1042
3.2.0-ci1043
3.2.1
3.2.1-ci1000
3.2.1-ci1001
3.2.1-ci1002
3.3.0
3.3.0-ci1000
3.3.0-ci1001
3.3.0-ci1002
3.3.0-ci1003
3.3.0-ci1004
3.3.0-ci1005
3.3.0-ci1006
3.3.0-ci1007
3.3.0-ci1008
3.3.0-ci1009
3.3.0-ci1016
3.3.0-ci1017
3.3.0-ci1018
3.3.0-ci1019
3.3.0-ci1020
3.3.0-ci1021
3.3.0-ci1022
3.3.0-ci1023
3.3.0-ci1024
3.3.0-ci1025
3.3.0-ci1026
3.3.0-ci1027
3.3.0-ci1028
3.3.0-ci1029
3.3.0-ci1030
3.3.0-ci1031
3.3.0-ci1032
3.3.0-ci1033
3.3.1
4.0.0
4.0.0-alpha1
4.0.0-ci1002
4.0.0-ci1004
4.0.0-ci1006
4.0.0-ci1007
4.0.0-ci1014
4.0.0-ci1015
4.0.0-ci1017
4.0.0-ci1018
4.0.0-ci1019
4.0.0-ci1020
4.0.0-ci1021
4.0.0-ci1026
4.0.0-ci1031
4.0.0-ci1032
4.0.0-ci1034
4.0.0-ci1036
4.0.0-ci1038
4.0.0-ci1046
4.0.0-ci1049
4.0.0-ci1050
4.0.0-ci1051
4.0.0-ci1052
4.0.0-ci1053
4.0.0-ci1054
4.0.0-ci1056
4.0.0-ci1057
4.0.0-ci1061
4.0.1
4.0.2
4.0.3
4.0.4
4.1.0
4.1.1
4.2.0
4.2.1
5.0.0
5.0.0-beta-1
5.0.1
5.0.2
5.1.0
5.1.1
5.2.0
6.0.0
6.0.1
6.0.2
6.1.0
6.1.1
6.2.0
6.2.1
6.2.2
7.0.0
7.0.0-alpha-0001
7.0.1
8.0.0
8.1.0
8.1.1
9.0.0
Fixed in
15.1.1
16.1.1
References
Updated Sep 10, 2026 · Source: OSV.dev |
6.2.2
patch
Dependencies (11)
+ 3 more |
|
6.2.1
patch
1 CVE
CVE-2026-32933
GHSA-rvv3-g6hj-g44x
Mar 13, 2026
AutoMapper Vulnerable to Denial of Service (DoS) via Uncontrolled Recursion
7.5
/ 10
High
Network
Low
None
None
Unchanged
None
None
High
SummaryAutoMapper is vulnerable to a Denial of Service (DoS) attack. When mapping deeply nested object graphs, the library uses recursive method calls without enforcing a default maximum depth limit. This allows an attacker to provide a specially crafted object graph that exhausts the thread's stack memory, triggering a DescriptionThe vulnerability exists in the core mapping engine. When a source object contains a property of the same type (or a type that eventually points back to itself), AutoMapper recursively attempts to map each level. Because there is no default limit on how many levels deep this recursion can go, a sufficiently nested object (approximately 25,000+ levels in standard .NET environments) will exceed the stack size. Since Impact
Proof of Concept (PoC)The following C# code demonstrates the crash by creating a nested "Circular" object graph and attempting to map it: Recommended Mitigation
Affected versions
16.0.0
16.1.0
1.1.0.118
1.1.1
1.1.2
10.0.0
10.1.0
10.1.1
11.0.0
11.0.1
12.0.0
12.0.1
+ 217 more Show less
13.0.0
13.0.1
14.0.0
15.0.0
15.0.1
15.1.0
2.0.0
2.1.1
2.1.262
2.1.265
2.1.266
2.1.267
2.2.0
2.2.1
2.2.1-ci10
2.2.1-ci1000
2.2.1-ci11
2.2.1-ci15
2.2.1-ci16
2.2.1-ci17
2.2.1-ci4
2.2.1-ci5
2.2.1-ci6
2.2.1-ci7
2.2.1-ci8
2.2.1-ci9
2.2.1-ci9000
2.2.1-ci9001
2.2.1-ci9002
2.2.1-ci9003
2.2.1-ci9004
2.2.1-ci9005
2.2.1-ci9006
2.2.24-ci
2.2.25-ci
3.0.0
3.0.0-ci1026
3.0.0-ci1028
3.0.0-ci1029
3.0.0-ci1031
3.0.0-ci1032
3.0.0-ci1033
3.0.0-ci1034
3.0.0-ci1035
3.0.0-ci1036
3.0.0-ci1037
3.0.0-ci1038
3.0.0-ci1039
3.0.0-ci1040
3.0.0-ci1041
3.0.0-ci1042
3.0.0-ci1043
3.0.0-ci1053
3.1.0
3.1.0-ci1014
3.1.0-ci1016
3.1.0-ci1017
3.1.0-ci1018
3.1.0-ci1019
3.1.0-ci1020
3.1.0-ci1021
3.1.0-ci1022
3.1.0-ci1023
3.1.0-ci1024
3.1.0-ci1026
3.1.0-ci1027
3.1.0-ci1032
3.1.0-ci1033
3.1.0-ci1034
3.1.0-ci1035
3.1.0-ci1036
3.1.0-ci1037
3.1.0-ci1038
3.1.0-ci1043
3.1.0-ci1044
3.1.0-ci1045
3.1.0-ci1046
3.1.0-ci1047
3.1.0-ci1048
3.1.0-ci1049
3.1.0-ci1050
3.1.0-ci1051
3.1.0-ci1053
3.1.0-ci1056
3.1.0-ci1058
3.1.1
3.1.1-ci1000
3.1.1-ci1003
3.2.0
3.2.0-ci1000
3.2.0-ci1001
3.2.0-ci1002
3.2.0-ci1003
3.2.0-ci1004
3.2.0-ci1005
3.2.0-ci1008
3.2.0-ci1009
3.2.0-ci1010
3.2.0-ci1011
3.2.0-ci1014
3.2.0-ci1015
3.2.0-ci1016
3.2.0-ci1017
3.2.0-ci1021
3.2.0-ci1022
3.2.0-ci1023
3.2.0-ci1024
3.2.0-ci1025
3.2.0-ci1026
3.2.0-ci1027
3.2.0-ci1028
3.2.0-ci1029
3.2.0-ci1030
3.2.0-ci1033
3.2.0-ci1034
3.2.0-ci1035
3.2.0-ci1036
3.2.0-ci1037
3.2.0-ci1038
3.2.0-ci1039
3.2.0-ci1040
3.2.0-ci1041
3.2.0-ci1042
3.2.0-ci1043
3.2.1
3.2.1-ci1000
3.2.1-ci1001
3.2.1-ci1002
3.3.0
3.3.0-ci1000
3.3.0-ci1001
3.3.0-ci1002
3.3.0-ci1003
3.3.0-ci1004
3.3.0-ci1005
3.3.0-ci1006
3.3.0-ci1007
3.3.0-ci1008
3.3.0-ci1009
3.3.0-ci1016
3.3.0-ci1017
3.3.0-ci1018
3.3.0-ci1019
3.3.0-ci1020
3.3.0-ci1021
3.3.0-ci1022
3.3.0-ci1023
3.3.0-ci1024
3.3.0-ci1025
3.3.0-ci1026
3.3.0-ci1027
3.3.0-ci1028
3.3.0-ci1029
3.3.0-ci1030
3.3.0-ci1031
3.3.0-ci1032
3.3.0-ci1033
3.3.1
4.0.0
4.0.0-alpha1
4.0.0-ci1002
4.0.0-ci1004
4.0.0-ci1006
4.0.0-ci1007
4.0.0-ci1014
4.0.0-ci1015
4.0.0-ci1017
4.0.0-ci1018
4.0.0-ci1019
4.0.0-ci1020
4.0.0-ci1021
4.0.0-ci1026
4.0.0-ci1031
4.0.0-ci1032
4.0.0-ci1034
4.0.0-ci1036
4.0.0-ci1038
4.0.0-ci1046
4.0.0-ci1049
4.0.0-ci1050
4.0.0-ci1051
4.0.0-ci1052
4.0.0-ci1053
4.0.0-ci1054
4.0.0-ci1056
4.0.0-ci1057
4.0.0-ci1061
4.0.1
4.0.2
4.0.3
4.0.4
4.1.0
4.1.1
4.2.0
4.2.1
5.0.0
5.0.0-beta-1
5.0.1
5.0.2
5.1.0
5.1.1
5.2.0
6.0.0
6.0.1
6.0.2
6.1.0
6.1.1
6.2.0
6.2.1
6.2.2
7.0.0
7.0.0-alpha-0001
7.0.1
8.0.0
8.1.0
8.1.1
9.0.0
Fixed in
15.1.1
16.1.1
References
Updated Sep 10, 2026 · Source: OSV.dev |
6.2.1
patch
Dependencies (11)
+ 3 more |
|
6.2.0
minor
1 CVE
CVE-2026-32933
GHSA-rvv3-g6hj-g44x
Mar 13, 2026
AutoMapper Vulnerable to Denial of Service (DoS) via Uncontrolled Recursion
7.5
/ 10
High
Network
Low
None
None
Unchanged
None
None
High
SummaryAutoMapper is vulnerable to a Denial of Service (DoS) attack. When mapping deeply nested object graphs, the library uses recursive method calls without enforcing a default maximum depth limit. This allows an attacker to provide a specially crafted object graph that exhausts the thread's stack memory, triggering a DescriptionThe vulnerability exists in the core mapping engine. When a source object contains a property of the same type (or a type that eventually points back to itself), AutoMapper recursively attempts to map each level. Because there is no default limit on how many levels deep this recursion can go, a sufficiently nested object (approximately 25,000+ levels in standard .NET environments) will exceed the stack size. Since Impact
Proof of Concept (PoC)The following C# code demonstrates the crash by creating a nested "Circular" object graph and attempting to map it: Recommended Mitigation
Affected versions
16.0.0
16.1.0
1.1.0.118
1.1.1
1.1.2
10.0.0
10.1.0
10.1.1
11.0.0
11.0.1
12.0.0
12.0.1
+ 217 more Show less
13.0.0
13.0.1
14.0.0
15.0.0
15.0.1
15.1.0
2.0.0
2.1.1
2.1.262
2.1.265
2.1.266
2.1.267
2.2.0
2.2.1
2.2.1-ci10
2.2.1-ci1000
2.2.1-ci11
2.2.1-ci15
2.2.1-ci16
2.2.1-ci17
2.2.1-ci4
2.2.1-ci5
2.2.1-ci6
2.2.1-ci7
2.2.1-ci8
2.2.1-ci9
2.2.1-ci9000
2.2.1-ci9001
2.2.1-ci9002
2.2.1-ci9003
2.2.1-ci9004
2.2.1-ci9005
2.2.1-ci9006
2.2.24-ci
2.2.25-ci
3.0.0
3.0.0-ci1026
3.0.0-ci1028
3.0.0-ci1029
3.0.0-ci1031
3.0.0-ci1032
3.0.0-ci1033
3.0.0-ci1034
3.0.0-ci1035
3.0.0-ci1036
3.0.0-ci1037
3.0.0-ci1038
3.0.0-ci1039
3.0.0-ci1040
3.0.0-ci1041
3.0.0-ci1042
3.0.0-ci1043
3.0.0-ci1053
3.1.0
3.1.0-ci1014
3.1.0-ci1016
3.1.0-ci1017
3.1.0-ci1018
3.1.0-ci1019
3.1.0-ci1020
3.1.0-ci1021
3.1.0-ci1022
3.1.0-ci1023
3.1.0-ci1024
3.1.0-ci1026
3.1.0-ci1027
3.1.0-ci1032
3.1.0-ci1033
3.1.0-ci1034
3.1.0-ci1035
3.1.0-ci1036
3.1.0-ci1037
3.1.0-ci1038
3.1.0-ci1043
3.1.0-ci1044
3.1.0-ci1045
3.1.0-ci1046
3.1.0-ci1047
3.1.0-ci1048
3.1.0-ci1049
3.1.0-ci1050
3.1.0-ci1051
3.1.0-ci1053
3.1.0-ci1056
3.1.0-ci1058
3.1.1
3.1.1-ci1000
3.1.1-ci1003
3.2.0
3.2.0-ci1000
3.2.0-ci1001
3.2.0-ci1002
3.2.0-ci1003
3.2.0-ci1004
3.2.0-ci1005
3.2.0-ci1008
3.2.0-ci1009
3.2.0-ci1010
3.2.0-ci1011
3.2.0-ci1014
3.2.0-ci1015
3.2.0-ci1016
3.2.0-ci1017
3.2.0-ci1021
3.2.0-ci1022
3.2.0-ci1023
3.2.0-ci1024
3.2.0-ci1025
3.2.0-ci1026
3.2.0-ci1027
3.2.0-ci1028
3.2.0-ci1029
3.2.0-ci1030
3.2.0-ci1033
3.2.0-ci1034
3.2.0-ci1035
3.2.0-ci1036
3.2.0-ci1037
3.2.0-ci1038
3.2.0-ci1039
3.2.0-ci1040
3.2.0-ci1041
3.2.0-ci1042
3.2.0-ci1043
3.2.1
3.2.1-ci1000
3.2.1-ci1001
3.2.1-ci1002
3.3.0
3.3.0-ci1000
3.3.0-ci1001
3.3.0-ci1002
3.3.0-ci1003
3.3.0-ci1004
3.3.0-ci1005
3.3.0-ci1006
3.3.0-ci1007
3.3.0-ci1008
3.3.0-ci1009
3.3.0-ci1016
3.3.0-ci1017
3.3.0-ci1018
3.3.0-ci1019
3.3.0-ci1020
3.3.0-ci1021
3.3.0-ci1022
3.3.0-ci1023
3.3.0-ci1024
3.3.0-ci1025
3.3.0-ci1026
3.3.0-ci1027
3.3.0-ci1028
3.3.0-ci1029
3.3.0-ci1030
3.3.0-ci1031
3.3.0-ci1032
3.3.0-ci1033
3.3.1
4.0.0
4.0.0-alpha1
4.0.0-ci1002
4.0.0-ci1004
4.0.0-ci1006
4.0.0-ci1007
4.0.0-ci1014
4.0.0-ci1015
4.0.0-ci1017
4.0.0-ci1018
4.0.0-ci1019
4.0.0-ci1020
4.0.0-ci1021
4.0.0-ci1026
4.0.0-ci1031
4.0.0-ci1032
4.0.0-ci1034
4.0.0-ci1036
4.0.0-ci1038
4.0.0-ci1046
4.0.0-ci1049
4.0.0-ci1050
4.0.0-ci1051
4.0.0-ci1052
4.0.0-ci1053
4.0.0-ci1054
4.0.0-ci1056
4.0.0-ci1057
4.0.0-ci1061
4.0.1
4.0.2
4.0.3
4.0.4
4.1.0
4.1.1
4.2.0
4.2.1
5.0.0
5.0.0-beta-1
5.0.1
5.0.2
5.1.0
5.1.1
5.2.0
6.0.0
6.0.1
6.0.2
6.1.0
6.1.1
6.2.0
6.2.1
6.2.2
7.0.0
7.0.0-alpha-0001
7.0.1
8.0.0
8.1.0
8.1.1
9.0.0
Fixed in
15.1.1
16.1.1
References
Updated Sep 10, 2026 · Source: OSV.dev |
6.2.0
minor
Dependencies (11)
+ 3 more |
|
6.1.1
patch
1 CVE
CVE-2026-32933
GHSA-rvv3-g6hj-g44x
Mar 13, 2026
AutoMapper Vulnerable to Denial of Service (DoS) via Uncontrolled Recursion
7.5
/ 10
High
Network
Low
None
None
Unchanged
None
None
High
SummaryAutoMapper is vulnerable to a Denial of Service (DoS) attack. When mapping deeply nested object graphs, the library uses recursive method calls without enforcing a default maximum depth limit. This allows an attacker to provide a specially crafted object graph that exhausts the thread's stack memory, triggering a DescriptionThe vulnerability exists in the core mapping engine. When a source object contains a property of the same type (or a type that eventually points back to itself), AutoMapper recursively attempts to map each level. Because there is no default limit on how many levels deep this recursion can go, a sufficiently nested object (approximately 25,000+ levels in standard .NET environments) will exceed the stack size. Since Impact
Proof of Concept (PoC)The following C# code demonstrates the crash by creating a nested "Circular" object graph and attempting to map it: Recommended Mitigation
Affected versions
16.0.0
16.1.0
1.1.0.118
1.1.1
1.1.2
10.0.0
10.1.0
10.1.1
11.0.0
11.0.1
12.0.0
12.0.1
+ 217 more Show less
13.0.0
13.0.1
14.0.0
15.0.0
15.0.1
15.1.0
2.0.0
2.1.1
2.1.262
2.1.265
2.1.266
2.1.267
2.2.0
2.2.1
2.2.1-ci10
2.2.1-ci1000
2.2.1-ci11
2.2.1-ci15
2.2.1-ci16
2.2.1-ci17
2.2.1-ci4
2.2.1-ci5
2.2.1-ci6
2.2.1-ci7
2.2.1-ci8
2.2.1-ci9
2.2.1-ci9000
2.2.1-ci9001
2.2.1-ci9002
2.2.1-ci9003
2.2.1-ci9004
2.2.1-ci9005
2.2.1-ci9006
2.2.24-ci
2.2.25-ci
3.0.0
3.0.0-ci1026
3.0.0-ci1028
3.0.0-ci1029
3.0.0-ci1031
3.0.0-ci1032
3.0.0-ci1033
3.0.0-ci1034
3.0.0-ci1035
3.0.0-ci1036
3.0.0-ci1037
3.0.0-ci1038
3.0.0-ci1039
3.0.0-ci1040
3.0.0-ci1041
3.0.0-ci1042
3.0.0-ci1043
3.0.0-ci1053
3.1.0
3.1.0-ci1014
3.1.0-ci1016
3.1.0-ci1017
3.1.0-ci1018
3.1.0-ci1019
3.1.0-ci1020
3.1.0-ci1021
3.1.0-ci1022
3.1.0-ci1023
3.1.0-ci1024
3.1.0-ci1026
3.1.0-ci1027
3.1.0-ci1032
3.1.0-ci1033
3.1.0-ci1034
3.1.0-ci1035
3.1.0-ci1036
3.1.0-ci1037
3.1.0-ci1038
3.1.0-ci1043
3.1.0-ci1044
3.1.0-ci1045
3.1.0-ci1046
3.1.0-ci1047
3.1.0-ci1048
3.1.0-ci1049
3.1.0-ci1050
3.1.0-ci1051
3.1.0-ci1053
3.1.0-ci1056
3.1.0-ci1058
3.1.1
3.1.1-ci1000
3.1.1-ci1003
3.2.0
3.2.0-ci1000
3.2.0-ci1001
3.2.0-ci1002
3.2.0-ci1003
3.2.0-ci1004
3.2.0-ci1005
3.2.0-ci1008
3.2.0-ci1009
3.2.0-ci1010
3.2.0-ci1011
3.2.0-ci1014
3.2.0-ci1015
3.2.0-ci1016
3.2.0-ci1017
3.2.0-ci1021
3.2.0-ci1022
3.2.0-ci1023
3.2.0-ci1024
3.2.0-ci1025
3.2.0-ci1026
3.2.0-ci1027
3.2.0-ci1028
3.2.0-ci1029
3.2.0-ci1030
3.2.0-ci1033
3.2.0-ci1034
3.2.0-ci1035
3.2.0-ci1036
3.2.0-ci1037
3.2.0-ci1038
3.2.0-ci1039
3.2.0-ci1040
3.2.0-ci1041
3.2.0-ci1042
3.2.0-ci1043
3.2.1
3.2.1-ci1000
3.2.1-ci1001
3.2.1-ci1002
3.3.0
3.3.0-ci1000
3.3.0-ci1001
3.3.0-ci1002
3.3.0-ci1003
3.3.0-ci1004
3.3.0-ci1005
3.3.0-ci1006
3.3.0-ci1007
3.3.0-ci1008
3.3.0-ci1009
3.3.0-ci1016
3.3.0-ci1017
3.3.0-ci1018
3.3.0-ci1019
3.3.0-ci1020
3.3.0-ci1021
3.3.0-ci1022
3.3.0-ci1023
3.3.0-ci1024
3.3.0-ci1025
3.3.0-ci1026
3.3.0-ci1027
3.3.0-ci1028
3.3.0-ci1029
3.3.0-ci1030
3.3.0-ci1031
3.3.0-ci1032
3.3.0-ci1033
3.3.1
4.0.0
4.0.0-alpha1
4.0.0-ci1002
4.0.0-ci1004
4.0.0-ci1006
4.0.0-ci1007
4.0.0-ci1014
4.0.0-ci1015
4.0.0-ci1017
4.0.0-ci1018
4.0.0-ci1019
4.0.0-ci1020
4.0.0-ci1021
4.0.0-ci1026
4.0.0-ci1031
4.0.0-ci1032
4.0.0-ci1034
4.0.0-ci1036
4.0.0-ci1038
4.0.0-ci1046
4.0.0-ci1049
4.0.0-ci1050
4.0.0-ci1051
4.0.0-ci1052
4.0.0-ci1053
4.0.0-ci1054
4.0.0-ci1056
4.0.0-ci1057
4.0.0-ci1061
4.0.1
4.0.2
4.0.3
4.0.4
4.1.0
4.1.1
4.2.0
4.2.1
5.0.0
5.0.0-beta-1
5.0.1
5.0.2
5.1.0
5.1.1
5.2.0
6.0.0
6.0.1
6.0.2
6.1.0
6.1.1
6.2.0
6.2.1
6.2.2
7.0.0
7.0.0-alpha-0001
7.0.1
8.0.0
8.1.0
8.1.1
9.0.0
Fixed in
15.1.1
16.1.1
References
Updated Sep 10, 2026 · Source: OSV.dev |
6.1.1
patch
Dependencies (18)
+ 10 more |
|
6.1.0
minor
1 CVE
CVE-2026-32933
GHSA-rvv3-g6hj-g44x
Mar 13, 2026
AutoMapper Vulnerable to Denial of Service (DoS) via Uncontrolled Recursion
7.5
/ 10
High
Network
Low
None
None
Unchanged
None
None
High
SummaryAutoMapper is vulnerable to a Denial of Service (DoS) attack. When mapping deeply nested object graphs, the library uses recursive method calls without enforcing a default maximum depth limit. This allows an attacker to provide a specially crafted object graph that exhausts the thread's stack memory, triggering a DescriptionThe vulnerability exists in the core mapping engine. When a source object contains a property of the same type (or a type that eventually points back to itself), AutoMapper recursively attempts to map each level. Because there is no default limit on how many levels deep this recursion can go, a sufficiently nested object (approximately 25,000+ levels in standard .NET environments) will exceed the stack size. Since Impact
Proof of Concept (PoC)The following C# code demonstrates the crash by creating a nested "Circular" object graph and attempting to map it: Recommended Mitigation
Affected versions
16.0.0
16.1.0
1.1.0.118
1.1.1
1.1.2
10.0.0
10.1.0
10.1.1
11.0.0
11.0.1
12.0.0
12.0.1
+ 217 more Show less
13.0.0
13.0.1
14.0.0
15.0.0
15.0.1
15.1.0
2.0.0
2.1.1
2.1.262
2.1.265
2.1.266
2.1.267
2.2.0
2.2.1
2.2.1-ci10
2.2.1-ci1000
2.2.1-ci11
2.2.1-ci15
2.2.1-ci16
2.2.1-ci17
2.2.1-ci4
2.2.1-ci5
2.2.1-ci6
2.2.1-ci7
2.2.1-ci8
2.2.1-ci9
2.2.1-ci9000
2.2.1-ci9001
2.2.1-ci9002
2.2.1-ci9003
2.2.1-ci9004
2.2.1-ci9005
2.2.1-ci9006
2.2.24-ci
2.2.25-ci
3.0.0
3.0.0-ci1026
3.0.0-ci1028
3.0.0-ci1029
3.0.0-ci1031
3.0.0-ci1032
3.0.0-ci1033
3.0.0-ci1034
3.0.0-ci1035
3.0.0-ci1036
3.0.0-ci1037
3.0.0-ci1038
3.0.0-ci1039
3.0.0-ci1040
3.0.0-ci1041
3.0.0-ci1042
3.0.0-ci1043
3.0.0-ci1053
3.1.0
3.1.0-ci1014
3.1.0-ci1016
3.1.0-ci1017
3.1.0-ci1018
3.1.0-ci1019
3.1.0-ci1020
3.1.0-ci1021
3.1.0-ci1022
3.1.0-ci1023
3.1.0-ci1024
3.1.0-ci1026
3.1.0-ci1027
3.1.0-ci1032
3.1.0-ci1033
3.1.0-ci1034
3.1.0-ci1035
3.1.0-ci1036
3.1.0-ci1037
3.1.0-ci1038
3.1.0-ci1043
3.1.0-ci1044
3.1.0-ci1045
3.1.0-ci1046
3.1.0-ci1047
3.1.0-ci1048
3.1.0-ci1049
3.1.0-ci1050
3.1.0-ci1051
3.1.0-ci1053
3.1.0-ci1056
3.1.0-ci1058
3.1.1
3.1.1-ci1000
3.1.1-ci1003
3.2.0
3.2.0-ci1000
3.2.0-ci1001
3.2.0-ci1002
3.2.0-ci1003
3.2.0-ci1004
3.2.0-ci1005
3.2.0-ci1008
3.2.0-ci1009
3.2.0-ci1010
3.2.0-ci1011
3.2.0-ci1014
3.2.0-ci1015
3.2.0-ci1016
3.2.0-ci1017
3.2.0-ci1021
3.2.0-ci1022
3.2.0-ci1023
3.2.0-ci1024
3.2.0-ci1025
3.2.0-ci1026
3.2.0-ci1027
3.2.0-ci1028
3.2.0-ci1029
3.2.0-ci1030
3.2.0-ci1033
3.2.0-ci1034
3.2.0-ci1035
3.2.0-ci1036
3.2.0-ci1037
3.2.0-ci1038
3.2.0-ci1039
3.2.0-ci1040
3.2.0-ci1041
3.2.0-ci1042
3.2.0-ci1043
3.2.1
3.2.1-ci1000
3.2.1-ci1001
3.2.1-ci1002
3.3.0
3.3.0-ci1000
3.3.0-ci1001
3.3.0-ci1002
3.3.0-ci1003
3.3.0-ci1004
3.3.0-ci1005
3.3.0-ci1006
3.3.0-ci1007
3.3.0-ci1008
3.3.0-ci1009
3.3.0-ci1016
3.3.0-ci1017
3.3.0-ci1018
3.3.0-ci1019
3.3.0-ci1020
3.3.0-ci1021
3.3.0-ci1022
3.3.0-ci1023
3.3.0-ci1024
3.3.0-ci1025
3.3.0-ci1026
3.3.0-ci1027
3.3.0-ci1028
3.3.0-ci1029
3.3.0-ci1030
3.3.0-ci1031
3.3.0-ci1032
3.3.0-ci1033
3.3.1
4.0.0
4.0.0-alpha1
4.0.0-ci1002
4.0.0-ci1004
4.0.0-ci1006
4.0.0-ci1007
4.0.0-ci1014
4.0.0-ci1015
4.0.0-ci1017
4.0.0-ci1018
4.0.0-ci1019
4.0.0-ci1020
4.0.0-ci1021
4.0.0-ci1026
4.0.0-ci1031
4.0.0-ci1032
4.0.0-ci1034
4.0.0-ci1036
4.0.0-ci1038
4.0.0-ci1046
4.0.0-ci1049
4.0.0-ci1050
4.0.0-ci1051
4.0.0-ci1052
4.0.0-ci1053
4.0.0-ci1054
4.0.0-ci1056
4.0.0-ci1057
4.0.0-ci1061
4.0.1
4.0.2
4.0.3
4.0.4
4.1.0
4.1.1
4.2.0
4.2.1
5.0.0
5.0.0-beta-1
5.0.1
5.0.2
5.1.0
5.1.1
5.2.0
6.0.0
6.0.1
6.0.2
6.1.0
6.1.1
6.2.0
6.2.1
6.2.2
7.0.0
7.0.0-alpha-0001
7.0.1
8.0.0
8.1.0
8.1.1
9.0.0
Fixed in
15.1.1
16.1.1
References
Updated Sep 10, 2026 · Source: OSV.dev |
6.1.0
minor
Dependencies (18)
+ 10 more |
|
6.0.2
major
1 CVE
CVE-2026-32933
GHSA-rvv3-g6hj-g44x
Mar 13, 2026
AutoMapper Vulnerable to Denial of Service (DoS) via Uncontrolled Recursion
7.5
/ 10
High
Network
Low
None
None
Unchanged
None
None
High
SummaryAutoMapper is vulnerable to a Denial of Service (DoS) attack. When mapping deeply nested object graphs, the library uses recursive method calls without enforcing a default maximum depth limit. This allows an attacker to provide a specially crafted object graph that exhausts the thread's stack memory, triggering a DescriptionThe vulnerability exists in the core mapping engine. When a source object contains a property of the same type (or a type that eventually points back to itself), AutoMapper recursively attempts to map each level. Because there is no default limit on how many levels deep this recursion can go, a sufficiently nested object (approximately 25,000+ levels in standard .NET environments) will exceed the stack size. Since Impact
Proof of Concept (PoC)The following C# code demonstrates the crash by creating a nested "Circular" object graph and attempting to map it: Recommended Mitigation
Affected versions
16.0.0
16.1.0
1.1.0.118
1.1.1
1.1.2
10.0.0
10.1.0
10.1.1
11.0.0
11.0.1
12.0.0
12.0.1
+ 217 more Show less
13.0.0
13.0.1
14.0.0
15.0.0
15.0.1
15.1.0
2.0.0
2.1.1
2.1.262
2.1.265
2.1.266
2.1.267
2.2.0
2.2.1
2.2.1-ci10
2.2.1-ci1000
2.2.1-ci11
2.2.1-ci15
2.2.1-ci16
2.2.1-ci17
2.2.1-ci4
2.2.1-ci5
2.2.1-ci6
2.2.1-ci7
2.2.1-ci8
2.2.1-ci9
2.2.1-ci9000
2.2.1-ci9001
2.2.1-ci9002
2.2.1-ci9003
2.2.1-ci9004
2.2.1-ci9005
2.2.1-ci9006
2.2.24-ci
2.2.25-ci
3.0.0
3.0.0-ci1026
3.0.0-ci1028
3.0.0-ci1029
3.0.0-ci1031
3.0.0-ci1032
3.0.0-ci1033
3.0.0-ci1034
3.0.0-ci1035
3.0.0-ci1036
3.0.0-ci1037
3.0.0-ci1038
3.0.0-ci1039
3.0.0-ci1040
3.0.0-ci1041
3.0.0-ci1042
3.0.0-ci1043
3.0.0-ci1053
3.1.0
3.1.0-ci1014
3.1.0-ci1016
3.1.0-ci1017
3.1.0-ci1018
3.1.0-ci1019
3.1.0-ci1020
3.1.0-ci1021
3.1.0-ci1022
3.1.0-ci1023
3.1.0-ci1024
3.1.0-ci1026
3.1.0-ci1027
3.1.0-ci1032
3.1.0-ci1033
3.1.0-ci1034
3.1.0-ci1035
3.1.0-ci1036
3.1.0-ci1037
3.1.0-ci1038
3.1.0-ci1043
3.1.0-ci1044
3.1.0-ci1045
3.1.0-ci1046
3.1.0-ci1047
3.1.0-ci1048
3.1.0-ci1049
3.1.0-ci1050
3.1.0-ci1051
3.1.0-ci1053
3.1.0-ci1056
3.1.0-ci1058
3.1.1
3.1.1-ci1000
3.1.1-ci1003
3.2.0
3.2.0-ci1000
3.2.0-ci1001
3.2.0-ci1002
3.2.0-ci1003
3.2.0-ci1004
3.2.0-ci1005
3.2.0-ci1008
3.2.0-ci1009
3.2.0-ci1010
3.2.0-ci1011
3.2.0-ci1014
3.2.0-ci1015
3.2.0-ci1016
3.2.0-ci1017
3.2.0-ci1021
3.2.0-ci1022
3.2.0-ci1023
3.2.0-ci1024
3.2.0-ci1025
3.2.0-ci1026
3.2.0-ci1027
3.2.0-ci1028
3.2.0-ci1029
3.2.0-ci1030
3.2.0-ci1033
3.2.0-ci1034
3.2.0-ci1035
3.2.0-ci1036
3.2.0-ci1037
3.2.0-ci1038
3.2.0-ci1039
3.2.0-ci1040
3.2.0-ci1041
3.2.0-ci1042
3.2.0-ci1043
3.2.1
3.2.1-ci1000
3.2.1-ci1001
3.2.1-ci1002
3.3.0
3.3.0-ci1000
3.3.0-ci1001
3.3.0-ci1002
3.3.0-ci1003
3.3.0-ci1004
3.3.0-ci1005
3.3.0-ci1006
3.3.0-ci1007
3.3.0-ci1008
3.3.0-ci1009
3.3.0-ci1016
3.3.0-ci1017
3.3.0-ci1018
3.3.0-ci1019
3.3.0-ci1020
3.3.0-ci1021
3.3.0-ci1022
3.3.0-ci1023
3.3.0-ci1024
3.3.0-ci1025
3.3.0-ci1026
3.3.0-ci1027
3.3.0-ci1028
3.3.0-ci1029
3.3.0-ci1030
3.3.0-ci1031
3.3.0-ci1032
3.3.0-ci1033
3.3.1
4.0.0
4.0.0-alpha1
4.0.0-ci1002
4.0.0-ci1004
4.0.0-ci1006
4.0.0-ci1007
4.0.0-ci1014
4.0.0-ci1015
4.0.0-ci1017
4.0.0-ci1018
4.0.0-ci1019
4.0.0-ci1020
4.0.0-ci1021
4.0.0-ci1026
4.0.0-ci1031
4.0.0-ci1032
4.0.0-ci1034
4.0.0-ci1036
4.0.0-ci1038
4.0.0-ci1046
4.0.0-ci1049
4.0.0-ci1050
4.0.0-ci1051
4.0.0-ci1052
4.0.0-ci1053
4.0.0-ci1054
4.0.0-ci1056
4.0.0-ci1057
4.0.0-ci1061
4.0.1
4.0.2
4.0.3
4.0.4
4.1.0
4.1.1
4.2.0
4.2.1
5.0.0
5.0.0-beta-1
5.0.1
5.0.2
5.1.0
5.1.1
5.2.0
6.0.0
6.0.1
6.0.2
6.1.0
6.1.1
6.2.0
6.2.1
6.2.2
7.0.0
7.0.0-alpha-0001
7.0.1
8.0.0
8.1.0
8.1.1
9.0.0
Fixed in
15.1.1
16.1.1
References
Updated Sep 10, 2026 · Source: OSV.dev |
6.0.2
major
Dependencies (18)
+ 10 more |
|
1.1.2
patch
1 CVE
CVE-2026-32933
GHSA-rvv3-g6hj-g44x
Mar 13, 2026
AutoMapper Vulnerable to Denial of Service (DoS) via Uncontrolled Recursion
7.5
/ 10
High
Network
Low
None
None
Unchanged
None
None
High
SummaryAutoMapper is vulnerable to a Denial of Service (DoS) attack. When mapping deeply nested object graphs, the library uses recursive method calls without enforcing a default maximum depth limit. This allows an attacker to provide a specially crafted object graph that exhausts the thread's stack memory, triggering a DescriptionThe vulnerability exists in the core mapping engine. When a source object contains a property of the same type (or a type that eventually points back to itself), AutoMapper recursively attempts to map each level. Because there is no default limit on how many levels deep this recursion can go, a sufficiently nested object (approximately 25,000+ levels in standard .NET environments) will exceed the stack size. Since Impact
Proof of Concept (PoC)The following C# code demonstrates the crash by creating a nested "Circular" object graph and attempting to map it: Recommended Mitigation
Affected versions
16.0.0
16.1.0
1.1.0.118
1.1.1
1.1.2
10.0.0
10.1.0
10.1.1
11.0.0
11.0.1
12.0.0
12.0.1
+ 217 more Show less
13.0.0
13.0.1
14.0.0
15.0.0
15.0.1
15.1.0
2.0.0
2.1.1
2.1.262
2.1.265
2.1.266
2.1.267
2.2.0
2.2.1
2.2.1-ci10
2.2.1-ci1000
2.2.1-ci11
2.2.1-ci15
2.2.1-ci16
2.2.1-ci17
2.2.1-ci4
2.2.1-ci5
2.2.1-ci6
2.2.1-ci7
2.2.1-ci8
2.2.1-ci9
2.2.1-ci9000
2.2.1-ci9001
2.2.1-ci9002
2.2.1-ci9003
2.2.1-ci9004
2.2.1-ci9005
2.2.1-ci9006
2.2.24-ci
2.2.25-ci
3.0.0
3.0.0-ci1026
3.0.0-ci1028
3.0.0-ci1029
3.0.0-ci1031
3.0.0-ci1032
3.0.0-ci1033
3.0.0-ci1034
3.0.0-ci1035
3.0.0-ci1036
3.0.0-ci1037
3.0.0-ci1038
3.0.0-ci1039
3.0.0-ci1040
3.0.0-ci1041
3.0.0-ci1042
3.0.0-ci1043
3.0.0-ci1053
3.1.0
3.1.0-ci1014
3.1.0-ci1016
3.1.0-ci1017
3.1.0-ci1018
3.1.0-ci1019
3.1.0-ci1020
3.1.0-ci1021
3.1.0-ci1022
3.1.0-ci1023
3.1.0-ci1024
3.1.0-ci1026
3.1.0-ci1027
3.1.0-ci1032
3.1.0-ci1033
3.1.0-ci1034
3.1.0-ci1035
3.1.0-ci1036
3.1.0-ci1037
3.1.0-ci1038
3.1.0-ci1043
3.1.0-ci1044
3.1.0-ci1045
3.1.0-ci1046
3.1.0-ci1047
3.1.0-ci1048
3.1.0-ci1049
3.1.0-ci1050
3.1.0-ci1051
3.1.0-ci1053
3.1.0-ci1056
3.1.0-ci1058
3.1.1
3.1.1-ci1000
3.1.1-ci1003
3.2.0
3.2.0-ci1000
3.2.0-ci1001
3.2.0-ci1002
3.2.0-ci1003
3.2.0-ci1004
3.2.0-ci1005
3.2.0-ci1008
3.2.0-ci1009
3.2.0-ci1010
3.2.0-ci1011
3.2.0-ci1014
3.2.0-ci1015
3.2.0-ci1016
3.2.0-ci1017
3.2.0-ci1021
3.2.0-ci1022
3.2.0-ci1023
3.2.0-ci1024
3.2.0-ci1025
3.2.0-ci1026
3.2.0-ci1027
3.2.0-ci1028
3.2.0-ci1029
3.2.0-ci1030
3.2.0-ci1033
3.2.0-ci1034
3.2.0-ci1035
3.2.0-ci1036
3.2.0-ci1037
3.2.0-ci1038
3.2.0-ci1039
3.2.0-ci1040
3.2.0-ci1041
3.2.0-ci1042
3.2.0-ci1043
3.2.1
3.2.1-ci1000
3.2.1-ci1001
3.2.1-ci1002
3.3.0
3.3.0-ci1000
3.3.0-ci1001
3.3.0-ci1002
3.3.0-ci1003
3.3.0-ci1004
3.3.0-ci1005
3.3.0-ci1006
3.3.0-ci1007
3.3.0-ci1008
3.3.0-ci1009
3.3.0-ci1016
3.3.0-ci1017
3.3.0-ci1018
3.3.0-ci1019
3.3.0-ci1020
3.3.0-ci1021
3.3.0-ci1022
3.3.0-ci1023
3.3.0-ci1024
3.3.0-ci1025
3.3.0-ci1026
3.3.0-ci1027
3.3.0-ci1028
3.3.0-ci1029
3.3.0-ci1030
3.3.0-ci1031
3.3.0-ci1032
3.3.0-ci1033
3.3.1
4.0.0
4.0.0-alpha1
4.0.0-ci1002
4.0.0-ci1004
4.0.0-ci1006
4.0.0-ci1007
4.0.0-ci1014
4.0.0-ci1015
4.0.0-ci1017
4.0.0-ci1018
4.0.0-ci1019
4.0.0-ci1020
4.0.0-ci1021
4.0.0-ci1026
4.0.0-ci1031
4.0.0-ci1032
4.0.0-ci1034
4.0.0-ci1036
4.0.0-ci1038
4.0.0-ci1046
4.0.0-ci1049
4.0.0-ci1050
4.0.0-ci1051
4.0.0-ci1052
4.0.0-ci1053
4.0.0-ci1054
4.0.0-ci1056
4.0.0-ci1057
4.0.0-ci1061
4.0.1
4.0.2
4.0.3
4.0.4
4.1.0
4.1.1
4.2.0
4.2.1
5.0.0
5.0.0-beta-1
5.0.1
5.0.2
5.1.0
5.1.1
5.2.0
6.0.0
6.0.1
6.0.2
6.1.0
6.1.1
6.2.0
6.2.1
6.2.2
7.0.0
7.0.0-alpha-0001
7.0.1
8.0.0
8.1.0
8.1.1
9.0.0
Fixed in
15.1.1
16.1.1
References
Updated Sep 10, 2026 · Source: OSV.dev |
1.1.2
patch
|
|
5.2.0
minor
1 CVE
CVE-2026-32933
GHSA-rvv3-g6hj-g44x
Mar 13, 2026
AutoMapper Vulnerable to Denial of Service (DoS) via Uncontrolled Recursion
7.5
/ 10
High
Network
Low
None
None
Unchanged
None
None
High
SummaryAutoMapper is vulnerable to a Denial of Service (DoS) attack. When mapping deeply nested object graphs, the library uses recursive method calls without enforcing a default maximum depth limit. This allows an attacker to provide a specially crafted object graph that exhausts the thread's stack memory, triggering a DescriptionThe vulnerability exists in the core mapping engine. When a source object contains a property of the same type (or a type that eventually points back to itself), AutoMapper recursively attempts to map each level. Because there is no default limit on how many levels deep this recursion can go, a sufficiently nested object (approximately 25,000+ levels in standard .NET environments) will exceed the stack size. Since Impact
Proof of Concept (PoC)The following C# code demonstrates the crash by creating a nested "Circular" object graph and attempting to map it: Recommended Mitigation
Affected versions
16.0.0
16.1.0
1.1.0.118
1.1.1
1.1.2
10.0.0
10.1.0
10.1.1
11.0.0
11.0.1
12.0.0
12.0.1
+ 217 more Show less
13.0.0
13.0.1
14.0.0
15.0.0
15.0.1
15.1.0
2.0.0
2.1.1
2.1.262
2.1.265
2.1.266
2.1.267
2.2.0
2.2.1
2.2.1-ci10
2.2.1-ci1000
2.2.1-ci11
2.2.1-ci15
2.2.1-ci16
2.2.1-ci17
2.2.1-ci4
2.2.1-ci5
2.2.1-ci6
2.2.1-ci7
2.2.1-ci8
2.2.1-ci9
2.2.1-ci9000
2.2.1-ci9001
2.2.1-ci9002
2.2.1-ci9003
2.2.1-ci9004
2.2.1-ci9005
2.2.1-ci9006
2.2.24-ci
2.2.25-ci
3.0.0
3.0.0-ci1026
3.0.0-ci1028
3.0.0-ci1029
3.0.0-ci1031
3.0.0-ci1032
3.0.0-ci1033
3.0.0-ci1034
3.0.0-ci1035
3.0.0-ci1036
3.0.0-ci1037
3.0.0-ci1038
3.0.0-ci1039
3.0.0-ci1040
3.0.0-ci1041
3.0.0-ci1042
3.0.0-ci1043
3.0.0-ci1053
3.1.0
3.1.0-ci1014
3.1.0-ci1016
3.1.0-ci1017
3.1.0-ci1018
3.1.0-ci1019
3.1.0-ci1020
3.1.0-ci1021
3.1.0-ci1022
3.1.0-ci1023
3.1.0-ci1024
3.1.0-ci1026
3.1.0-ci1027
3.1.0-ci1032
3.1.0-ci1033
3.1.0-ci1034
3.1.0-ci1035
3.1.0-ci1036
3.1.0-ci1037
3.1.0-ci1038
3.1.0-ci1043
3.1.0-ci1044
3.1.0-ci1045
3.1.0-ci1046
3.1.0-ci1047
3.1.0-ci1048
3.1.0-ci1049
3.1.0-ci1050
3.1.0-ci1051
3.1.0-ci1053
3.1.0-ci1056
3.1.0-ci1058
3.1.1
3.1.1-ci1000
3.1.1-ci1003
3.2.0
3.2.0-ci1000
3.2.0-ci1001
3.2.0-ci1002
3.2.0-ci1003
3.2.0-ci1004
3.2.0-ci1005
3.2.0-ci1008
3.2.0-ci1009
3.2.0-ci1010
3.2.0-ci1011
3.2.0-ci1014
3.2.0-ci1015
3.2.0-ci1016
3.2.0-ci1017
3.2.0-ci1021
3.2.0-ci1022
3.2.0-ci1023
3.2.0-ci1024
3.2.0-ci1025
3.2.0-ci1026
3.2.0-ci1027
3.2.0-ci1028
3.2.0-ci1029
3.2.0-ci1030
3.2.0-ci1033
3.2.0-ci1034
3.2.0-ci1035
3.2.0-ci1036
3.2.0-ci1037
3.2.0-ci1038
3.2.0-ci1039
3.2.0-ci1040
3.2.0-ci1041
3.2.0-ci1042
3.2.0-ci1043
3.2.1
3.2.1-ci1000
3.2.1-ci1001
3.2.1-ci1002
3.3.0
3.3.0-ci1000
3.3.0-ci1001
3.3.0-ci1002
3.3.0-ci1003
3.3.0-ci1004
3.3.0-ci1005
3.3.0-ci1006
3.3.0-ci1007
3.3.0-ci1008
3.3.0-ci1009
3.3.0-ci1016
3.3.0-ci1017
3.3.0-ci1018
3.3.0-ci1019
3.3.0-ci1020
3.3.0-ci1021
3.3.0-ci1022
3.3.0-ci1023
3.3.0-ci1024
3.3.0-ci1025
3.3.0-ci1026
3.3.0-ci1027
3.3.0-ci1028
3.3.0-ci1029
3.3.0-ci1030
3.3.0-ci1031
3.3.0-ci1032
3.3.0-ci1033
3.3.1
4.0.0
4.0.0-alpha1
4.0.0-ci1002
4.0.0-ci1004
4.0.0-ci1006
4.0.0-ci1007
4.0.0-ci1014
4.0.0-ci1015
4.0.0-ci1017
4.0.0-ci1018
4.0.0-ci1019
4.0.0-ci1020
4.0.0-ci1021
4.0.0-ci1026
4.0.0-ci1031
4.0.0-ci1032
4.0.0-ci1034
4.0.0-ci1036
4.0.0-ci1038
4.0.0-ci1046
4.0.0-ci1049
4.0.0-ci1050
4.0.0-ci1051
4.0.0-ci1052
4.0.0-ci1053
4.0.0-ci1054
4.0.0-ci1056
4.0.0-ci1057
4.0.0-ci1061
4.0.1
4.0.2
4.0.3
4.0.4
4.1.0
4.1.1
4.2.0
4.2.1
5.0.0
5.0.0-beta-1
5.0.1
5.0.2
5.1.0
5.1.1
5.2.0
6.0.0
6.0.1
6.0.2
6.1.0
6.1.1
6.2.0
6.2.1
6.2.2
7.0.0
7.0.0-alpha-0001
7.0.1
8.0.0
8.1.0
8.1.1
9.0.0
Fixed in
15.1.1
16.1.1
References
Updated Sep 10, 2026 · Source: OSV.dev |
5.2.0
minor
Dependencies (6)
|
|
5.1.1
minor
1 CVE
CVE-2026-32933
GHSA-rvv3-g6hj-g44x
Mar 13, 2026
AutoMapper Vulnerable to Denial of Service (DoS) via Uncontrolled Recursion
7.5
/ 10
High
Network
Low
None
None
Unchanged
None
None
High
SummaryAutoMapper is vulnerable to a Denial of Service (DoS) attack. When mapping deeply nested object graphs, the library uses recursive method calls without enforcing a default maximum depth limit. This allows an attacker to provide a specially crafted object graph that exhausts the thread's stack memory, triggering a DescriptionThe vulnerability exists in the core mapping engine. When a source object contains a property of the same type (or a type that eventually points back to itself), AutoMapper recursively attempts to map each level. Because there is no default limit on how many levels deep this recursion can go, a sufficiently nested object (approximately 25,000+ levels in standard .NET environments) will exceed the stack size. Since Impact
Proof of Concept (PoC)The following C# code demonstrates the crash by creating a nested "Circular" object graph and attempting to map it: Recommended Mitigation
Affected versions
16.0.0
16.1.0
1.1.0.118
1.1.1
1.1.2
10.0.0
10.1.0
10.1.1
11.0.0
11.0.1
12.0.0
12.0.1
+ 217 more Show less
13.0.0
13.0.1
14.0.0
15.0.0
15.0.1
15.1.0
2.0.0
2.1.1
2.1.262
2.1.265
2.1.266
2.1.267
2.2.0
2.2.1
2.2.1-ci10
2.2.1-ci1000
2.2.1-ci11
2.2.1-ci15
2.2.1-ci16
2.2.1-ci17
2.2.1-ci4
2.2.1-ci5
2.2.1-ci6
2.2.1-ci7
2.2.1-ci8
2.2.1-ci9
2.2.1-ci9000
2.2.1-ci9001
2.2.1-ci9002
2.2.1-ci9003
2.2.1-ci9004
2.2.1-ci9005
2.2.1-ci9006
2.2.24-ci
2.2.25-ci
3.0.0
3.0.0-ci1026
3.0.0-ci1028
3.0.0-ci1029
3.0.0-ci1031
3.0.0-ci1032
3.0.0-ci1033
3.0.0-ci1034
3.0.0-ci1035
3.0.0-ci1036
3.0.0-ci1037
3.0.0-ci1038
3.0.0-ci1039
3.0.0-ci1040
3.0.0-ci1041
3.0.0-ci1042
3.0.0-ci1043
3.0.0-ci1053
3.1.0
3.1.0-ci1014
3.1.0-ci1016
3.1.0-ci1017
3.1.0-ci1018
3.1.0-ci1019
3.1.0-ci1020
3.1.0-ci1021
3.1.0-ci1022
3.1.0-ci1023
3.1.0-ci1024
3.1.0-ci1026
3.1.0-ci1027
3.1.0-ci1032
3.1.0-ci1033
3.1.0-ci1034
3.1.0-ci1035
3.1.0-ci1036
3.1.0-ci1037
3.1.0-ci1038
3.1.0-ci1043
3.1.0-ci1044
3.1.0-ci1045
3.1.0-ci1046
3.1.0-ci1047
3.1.0-ci1048
3.1.0-ci1049
3.1.0-ci1050
3.1.0-ci1051
3.1.0-ci1053
3.1.0-ci1056
3.1.0-ci1058
3.1.1
3.1.1-ci1000
3.1.1-ci1003
3.2.0
3.2.0-ci1000
3.2.0-ci1001
3.2.0-ci1002
3.2.0-ci1003
3.2.0-ci1004
3.2.0-ci1005
3.2.0-ci1008
3.2.0-ci1009
3.2.0-ci1010
3.2.0-ci1011
3.2.0-ci1014
3.2.0-ci1015
3.2.0-ci1016
3.2.0-ci1017
3.2.0-ci1021
3.2.0-ci1022
3.2.0-ci1023
3.2.0-ci1024
3.2.0-ci1025
3.2.0-ci1026
3.2.0-ci1027
3.2.0-ci1028
3.2.0-ci1029
3.2.0-ci1030
3.2.0-ci1033
3.2.0-ci1034
3.2.0-ci1035
3.2.0-ci1036
3.2.0-ci1037
3.2.0-ci1038
3.2.0-ci1039
3.2.0-ci1040
3.2.0-ci1041
3.2.0-ci1042
3.2.0-ci1043
3.2.1
3.2.1-ci1000
3.2.1-ci1001
3.2.1-ci1002
3.3.0
3.3.0-ci1000
3.3.0-ci1001
3.3.0-ci1002
3.3.0-ci1003
3.3.0-ci1004
3.3.0-ci1005
3.3.0-ci1006
3.3.0-ci1007
3.3.0-ci1008
3.3.0-ci1009
3.3.0-ci1016
3.3.0-ci1017
3.3.0-ci1018
3.3.0-ci1019
3.3.0-ci1020
3.3.0-ci1021
3.3.0-ci1022
3.3.0-ci1023
3.3.0-ci1024
3.3.0-ci1025
3.3.0-ci1026
3.3.0-ci1027
3.3.0-ci1028
3.3.0-ci1029
3.3.0-ci1030
3.3.0-ci1031
3.3.0-ci1032
3.3.0-ci1033
3.3.1
4.0.0
4.0.0-alpha1
4.0.0-ci1002
4.0.0-ci1004
4.0.0-ci1006
4.0.0-ci1007
4.0.0-ci1014
4.0.0-ci1015
4.0.0-ci1017
4.0.0-ci1018
4.0.0-ci1019
4.0.0-ci1020
4.0.0-ci1021
4.0.0-ci1026
4.0.0-ci1031
4.0.0-ci1032
4.0.0-ci1034
4.0.0-ci1036
4.0.0-ci1038
4.0.0-ci1046
4.0.0-ci1049
4.0.0-ci1050
4.0.0-ci1051
4.0.0-ci1052
4.0.0-ci1053
4.0.0-ci1054
4.0.0-ci1056
4.0.0-ci1057
4.0.0-ci1061
4.0.1
4.0.2
4.0.3
4.0.4
4.1.0
4.1.1
4.2.0
4.2.1
5.0.0
5.0.0-beta-1
5.0.1
5.0.2
5.1.0
5.1.1
5.2.0
6.0.0
6.0.1
6.0.2
6.1.0
6.1.1
6.2.0
6.2.1
6.2.2
7.0.0
7.0.0-alpha-0001
7.0.1
8.0.0
8.1.0
8.1.1
9.0.0
Fixed in
15.1.1
16.1.1
References
Updated Sep 10, 2026 · Source: OSV.dev |
5.1.1
minor
Dependencies (6)
|
|
5.0.2
major
1 CVE
CVE-2026-32933
GHSA-rvv3-g6hj-g44x
Mar 13, 2026
AutoMapper Vulnerable to Denial of Service (DoS) via Uncontrolled Recursion
7.5
/ 10
High
Network
Low
None
None
Unchanged
None
None
High
SummaryAutoMapper is vulnerable to a Denial of Service (DoS) attack. When mapping deeply nested object graphs, the library uses recursive method calls without enforcing a default maximum depth limit. This allows an attacker to provide a specially crafted object graph that exhausts the thread's stack memory, triggering a DescriptionThe vulnerability exists in the core mapping engine. When a source object contains a property of the same type (or a type that eventually points back to itself), AutoMapper recursively attempts to map each level. Because there is no default limit on how many levels deep this recursion can go, a sufficiently nested object (approximately 25,000+ levels in standard .NET environments) will exceed the stack size. Since Impact
Proof of Concept (PoC)The following C# code demonstrates the crash by creating a nested "Circular" object graph and attempting to map it: Recommended Mitigation
Affected versions
16.0.0
16.1.0
1.1.0.118
1.1.1
1.1.2
10.0.0
10.1.0
10.1.1
11.0.0
11.0.1
12.0.0
12.0.1
+ 217 more Show less
13.0.0
13.0.1
14.0.0
15.0.0
15.0.1
15.1.0
2.0.0
2.1.1
2.1.262
2.1.265
2.1.266
2.1.267
2.2.0
2.2.1
2.2.1-ci10
2.2.1-ci1000
2.2.1-ci11
2.2.1-ci15
2.2.1-ci16
2.2.1-ci17
2.2.1-ci4
2.2.1-ci5
2.2.1-ci6
2.2.1-ci7
2.2.1-ci8
2.2.1-ci9
2.2.1-ci9000
2.2.1-ci9001
2.2.1-ci9002
2.2.1-ci9003
2.2.1-ci9004
2.2.1-ci9005
2.2.1-ci9006
2.2.24-ci
2.2.25-ci
3.0.0
3.0.0-ci1026
3.0.0-ci1028
3.0.0-ci1029
3.0.0-ci1031
3.0.0-ci1032
3.0.0-ci1033
3.0.0-ci1034
3.0.0-ci1035
3.0.0-ci1036
3.0.0-ci1037
3.0.0-ci1038
3.0.0-ci1039
3.0.0-ci1040
3.0.0-ci1041
3.0.0-ci1042
3.0.0-ci1043
3.0.0-ci1053
3.1.0
3.1.0-ci1014
3.1.0-ci1016
3.1.0-ci1017
3.1.0-ci1018
3.1.0-ci1019
3.1.0-ci1020
3.1.0-ci1021
3.1.0-ci1022
3.1.0-ci1023
3.1.0-ci1024
3.1.0-ci1026
3.1.0-ci1027
3.1.0-ci1032
3.1.0-ci1033
3.1.0-ci1034
3.1.0-ci1035
3.1.0-ci1036
3.1.0-ci1037
3.1.0-ci1038
3.1.0-ci1043
3.1.0-ci1044
3.1.0-ci1045
3.1.0-ci1046
3.1.0-ci1047
3.1.0-ci1048
3.1.0-ci1049
3.1.0-ci1050
3.1.0-ci1051
3.1.0-ci1053
3.1.0-ci1056
3.1.0-ci1058
3.1.1
3.1.1-ci1000
3.1.1-ci1003
3.2.0
3.2.0-ci1000
3.2.0-ci1001
3.2.0-ci1002
3.2.0-ci1003
3.2.0-ci1004
3.2.0-ci1005
3.2.0-ci1008
3.2.0-ci1009
3.2.0-ci1010
3.2.0-ci1011
3.2.0-ci1014
3.2.0-ci1015
3.2.0-ci1016
3.2.0-ci1017
3.2.0-ci1021
3.2.0-ci1022
3.2.0-ci1023
3.2.0-ci1024
3.2.0-ci1025
3.2.0-ci1026
3.2.0-ci1027
3.2.0-ci1028
3.2.0-ci1029
3.2.0-ci1030
3.2.0-ci1033
3.2.0-ci1034
3.2.0-ci1035
3.2.0-ci1036
3.2.0-ci1037
3.2.0-ci1038
3.2.0-ci1039
3.2.0-ci1040
3.2.0-ci1041
3.2.0-ci1042
3.2.0-ci1043
3.2.1
3.2.1-ci1000
3.2.1-ci1001
3.2.1-ci1002
3.3.0
3.3.0-ci1000
3.3.0-ci1001
3.3.0-ci1002
3.3.0-ci1003
3.3.0-ci1004
3.3.0-ci1005
3.3.0-ci1006
3.3.0-ci1007
3.3.0-ci1008
3.3.0-ci1009
3.3.0-ci1016
3.3.0-ci1017
3.3.0-ci1018
3.3.0-ci1019
3.3.0-ci1020
3.3.0-ci1021
3.3.0-ci1022
3.3.0-ci1023
3.3.0-ci1024
3.3.0-ci1025
3.3.0-ci1026
3.3.0-ci1027
3.3.0-ci1028
3.3.0-ci1029
3.3.0-ci1030
3.3.0-ci1031
3.3.0-ci1032
3.3.0-ci1033
3.3.1
4.0.0
4.0.0-alpha1
4.0.0-ci1002
4.0.0-ci1004
4.0.0-ci1006
4.0.0-ci1007
4.0.0-ci1014
4.0.0-ci1015
4.0.0-ci1017
4.0.0-ci1018
4.0.0-ci1019
4.0.0-ci1020
4.0.0-ci1021
4.0.0-ci1026
4.0.0-ci1031
4.0.0-ci1032
4.0.0-ci1034
4.0.0-ci1036
4.0.0-ci1038
4.0.0-ci1046
4.0.0-ci1049
4.0.0-ci1050
4.0.0-ci1051
4.0.0-ci1052
4.0.0-ci1053
4.0.0-ci1054
4.0.0-ci1056
4.0.0-ci1057
4.0.0-ci1061
4.0.1
4.0.2
4.0.3
4.0.4
4.1.0
4.1.1
4.2.0
4.2.1
5.0.0
5.0.0-beta-1
5.0.1
5.0.2
5.1.0
5.1.1
5.2.0
6.0.0
6.0.1
6.0.2
6.1.0
6.1.1
6.2.0
6.2.1
6.2.2
7.0.0
7.0.0-alpha-0001
7.0.1
8.0.0
8.1.0
8.1.1
9.0.0
Fixed in
15.1.1
16.1.1
References
Updated Sep 10, 2026 · Source: OSV.dev |
5.0.2
major
Dependencies (6)
|
|
5.0.0-beta-1
pre
1 CVE
CVE-2026-32933
GHSA-rvv3-g6hj-g44x
Mar 13, 2026
AutoMapper Vulnerable to Denial of Service (DoS) via Uncontrolled Recursion
7.5
/ 10
High
Network
Low
None
None
Unchanged
None
None
High
SummaryAutoMapper is vulnerable to a Denial of Service (DoS) attack. When mapping deeply nested object graphs, the library uses recursive method calls without enforcing a default maximum depth limit. This allows an attacker to provide a specially crafted object graph that exhausts the thread's stack memory, triggering a DescriptionThe vulnerability exists in the core mapping engine. When a source object contains a property of the same type (or a type that eventually points back to itself), AutoMapper recursively attempts to map each level. Because there is no default limit on how many levels deep this recursion can go, a sufficiently nested object (approximately 25,000+ levels in standard .NET environments) will exceed the stack size. Since Impact
Proof of Concept (PoC)The following C# code demonstrates the crash by creating a nested "Circular" object graph and attempting to map it: Recommended Mitigation
Affected versions
16.0.0
16.1.0
1.1.0.118
1.1.1
1.1.2
10.0.0
10.1.0
10.1.1
11.0.0
11.0.1
12.0.0
12.0.1
+ 217 more Show less
13.0.0
13.0.1
14.0.0
15.0.0
15.0.1
15.1.0
2.0.0
2.1.1
2.1.262
2.1.265
2.1.266
2.1.267
2.2.0
2.2.1
2.2.1-ci10
2.2.1-ci1000
2.2.1-ci11
2.2.1-ci15
2.2.1-ci16
2.2.1-ci17
2.2.1-ci4
2.2.1-ci5
2.2.1-ci6
2.2.1-ci7
2.2.1-ci8
2.2.1-ci9
2.2.1-ci9000
2.2.1-ci9001
2.2.1-ci9002
2.2.1-ci9003
2.2.1-ci9004
2.2.1-ci9005
2.2.1-ci9006
2.2.24-ci
2.2.25-ci
3.0.0
3.0.0-ci1026
3.0.0-ci1028
3.0.0-ci1029
3.0.0-ci1031
3.0.0-ci1032
3.0.0-ci1033
3.0.0-ci1034
3.0.0-ci1035
3.0.0-ci1036
3.0.0-ci1037
3.0.0-ci1038
3.0.0-ci1039
3.0.0-ci1040
3.0.0-ci1041
3.0.0-ci1042
3.0.0-ci1043
3.0.0-ci1053
3.1.0
3.1.0-ci1014
3.1.0-ci1016
3.1.0-ci1017
3.1.0-ci1018
3.1.0-ci1019
3.1.0-ci1020
3.1.0-ci1021
3.1.0-ci1022
3.1.0-ci1023
3.1.0-ci1024
3.1.0-ci1026
3.1.0-ci1027
3.1.0-ci1032
3.1.0-ci1033
3.1.0-ci1034
3.1.0-ci1035
3.1.0-ci1036
3.1.0-ci1037
3.1.0-ci1038
3.1.0-ci1043
3.1.0-ci1044
3.1.0-ci1045
3.1.0-ci1046
3.1.0-ci1047
3.1.0-ci1048
3.1.0-ci1049
3.1.0-ci1050
3.1.0-ci1051
3.1.0-ci1053
3.1.0-ci1056
3.1.0-ci1058
3.1.1
3.1.1-ci1000
3.1.1-ci1003
3.2.0
3.2.0-ci1000
3.2.0-ci1001
3.2.0-ci1002
3.2.0-ci1003
3.2.0-ci1004
3.2.0-ci1005
3.2.0-ci1008
3.2.0-ci1009
3.2.0-ci1010
3.2.0-ci1011
3.2.0-ci1014
3.2.0-ci1015
3.2.0-ci1016
3.2.0-ci1017
3.2.0-ci1021
3.2.0-ci1022
3.2.0-ci1023
3.2.0-ci1024
3.2.0-ci1025
3.2.0-ci1026
3.2.0-ci1027
3.2.0-ci1028
3.2.0-ci1029
3.2.0-ci1030
3.2.0-ci1033
3.2.0-ci1034
3.2.0-ci1035
3.2.0-ci1036
3.2.0-ci1037
3.2.0-ci1038
3.2.0-ci1039
3.2.0-ci1040
3.2.0-ci1041
3.2.0-ci1042
3.2.0-ci1043
3.2.1
3.2.1-ci1000
3.2.1-ci1001
3.2.1-ci1002
3.3.0
3.3.0-ci1000
3.3.0-ci1001
3.3.0-ci1002
3.3.0-ci1003
3.3.0-ci1004
3.3.0-ci1005
3.3.0-ci1006
3.3.0-ci1007
3.3.0-ci1008
3.3.0-ci1009
3.3.0-ci1016
3.3.0-ci1017
3.3.0-ci1018
3.3.0-ci1019
3.3.0-ci1020
3.3.0-ci1021
3.3.0-ci1022
3.3.0-ci1023
3.3.0-ci1024
3.3.0-ci1025
3.3.0-ci1026
3.3.0-ci1027
3.3.0-ci1028
3.3.0-ci1029
3.3.0-ci1030
3.3.0-ci1031
3.3.0-ci1032
3.3.0-ci1033
3.3.1
4.0.0
4.0.0-alpha1
4.0.0-ci1002
4.0.0-ci1004
4.0.0-ci1006
4.0.0-ci1007
4.0.0-ci1014
4.0.0-ci1015
4.0.0-ci1017
4.0.0-ci1018
4.0.0-ci1019
4.0.0-ci1020
4.0.0-ci1021
4.0.0-ci1026
4.0.0-ci1031
4.0.0-ci1032
4.0.0-ci1034
4.0.0-ci1036
4.0.0-ci1038
4.0.0-ci1046
4.0.0-ci1049
4.0.0-ci1050
4.0.0-ci1051
4.0.0-ci1052
4.0.0-ci1053
4.0.0-ci1054
4.0.0-ci1056
4.0.0-ci1057
4.0.0-ci1061
4.0.1
4.0.2
4.0.3
4.0.4
4.1.0
4.1.1
4.2.0
4.2.1
5.0.0
5.0.0-beta-1
5.0.1
5.0.2
5.1.0
5.1.1
5.2.0
6.0.0
6.0.1
6.0.2
6.1.0
6.1.1
6.2.0
6.2.1
6.2.2
7.0.0
7.0.0-alpha-0001
7.0.1
8.0.0
8.1.0
8.1.1
9.0.0
Fixed in
15.1.1
16.1.1
References
Updated Sep 10, 2026 · Source: OSV.dev |
5.0.0-beta-1
pre
Dependencies (5)
|
|
4.2.1
patch
1 CVE
CVE-2026-32933
GHSA-rvv3-g6hj-g44x
Mar 13, 2026
AutoMapper Vulnerable to Denial of Service (DoS) via Uncontrolled Recursion
7.5
/ 10
High
Network
Low
None
None
Unchanged
None
None
High
SummaryAutoMapper is vulnerable to a Denial of Service (DoS) attack. When mapping deeply nested object graphs, the library uses recursive method calls without enforcing a default maximum depth limit. This allows an attacker to provide a specially crafted object graph that exhausts the thread's stack memory, triggering a DescriptionThe vulnerability exists in the core mapping engine. When a source object contains a property of the same type (or a type that eventually points back to itself), AutoMapper recursively attempts to map each level. Because there is no default limit on how many levels deep this recursion can go, a sufficiently nested object (approximately 25,000+ levels in standard .NET environments) will exceed the stack size. Since Impact
Proof of Concept (PoC)The following C# code demonstrates the crash by creating a nested "Circular" object graph and attempting to map it: Recommended Mitigation
Affected versions
16.0.0
16.1.0
1.1.0.118
1.1.1
1.1.2
10.0.0
10.1.0
10.1.1
11.0.0
11.0.1
12.0.0
12.0.1
+ 217 more Show less
13.0.0
13.0.1
14.0.0
15.0.0
15.0.1
15.1.0
2.0.0
2.1.1
2.1.262
2.1.265
2.1.266
2.1.267
2.2.0
2.2.1
2.2.1-ci10
2.2.1-ci1000
2.2.1-ci11
2.2.1-ci15
2.2.1-ci16
2.2.1-ci17
2.2.1-ci4
2.2.1-ci5
2.2.1-ci6
2.2.1-ci7
2.2.1-ci8
2.2.1-ci9
2.2.1-ci9000
2.2.1-ci9001
2.2.1-ci9002
2.2.1-ci9003
2.2.1-ci9004
2.2.1-ci9005
2.2.1-ci9006
2.2.24-ci
2.2.25-ci
3.0.0
3.0.0-ci1026
3.0.0-ci1028
3.0.0-ci1029
3.0.0-ci1031
3.0.0-ci1032
3.0.0-ci1033
3.0.0-ci1034
3.0.0-ci1035
3.0.0-ci1036
3.0.0-ci1037
3.0.0-ci1038
3.0.0-ci1039
3.0.0-ci1040
3.0.0-ci1041
3.0.0-ci1042
3.0.0-ci1043
3.0.0-ci1053
3.1.0
3.1.0-ci1014
3.1.0-ci1016
3.1.0-ci1017
3.1.0-ci1018
3.1.0-ci1019
3.1.0-ci1020
3.1.0-ci1021
3.1.0-ci1022
3.1.0-ci1023
3.1.0-ci1024
3.1.0-ci1026
3.1.0-ci1027
3.1.0-ci1032
3.1.0-ci1033
3.1.0-ci1034
3.1.0-ci1035
3.1.0-ci1036
3.1.0-ci1037
3.1.0-ci1038
3.1.0-ci1043
3.1.0-ci1044
3.1.0-ci1045
3.1.0-ci1046
3.1.0-ci1047
3.1.0-ci1048
3.1.0-ci1049
3.1.0-ci1050
3.1.0-ci1051
3.1.0-ci1053
3.1.0-ci1056
3.1.0-ci1058
3.1.1
3.1.1-ci1000
3.1.1-ci1003
3.2.0
3.2.0-ci1000
3.2.0-ci1001
3.2.0-ci1002
3.2.0-ci1003
3.2.0-ci1004
3.2.0-ci1005
3.2.0-ci1008
3.2.0-ci1009
3.2.0-ci1010
3.2.0-ci1011
3.2.0-ci1014
3.2.0-ci1015
3.2.0-ci1016
3.2.0-ci1017
3.2.0-ci1021
3.2.0-ci1022
3.2.0-ci1023
3.2.0-ci1024
3.2.0-ci1025
3.2.0-ci1026
3.2.0-ci1027
3.2.0-ci1028
3.2.0-ci1029
3.2.0-ci1030
3.2.0-ci1033
3.2.0-ci1034
3.2.0-ci1035
3.2.0-ci1036
3.2.0-ci1037
3.2.0-ci1038
3.2.0-ci1039
3.2.0-ci1040
3.2.0-ci1041
3.2.0-ci1042
3.2.0-ci1043
3.2.1
3.2.1-ci1000
3.2.1-ci1001
3.2.1-ci1002
3.3.0
3.3.0-ci1000
3.3.0-ci1001
3.3.0-ci1002
3.3.0-ci1003
3.3.0-ci1004
3.3.0-ci1005
3.3.0-ci1006
3.3.0-ci1007
3.3.0-ci1008
3.3.0-ci1009
3.3.0-ci1016
3.3.0-ci1017
3.3.0-ci1018
3.3.0-ci1019
3.3.0-ci1020
3.3.0-ci1021
3.3.0-ci1022
3.3.0-ci1023
3.3.0-ci1024
3.3.0-ci1025
3.3.0-ci1026
3.3.0-ci1027
3.3.0-ci1028
3.3.0-ci1029
3.3.0-ci1030
3.3.0-ci1031
3.3.0-ci1032
3.3.0-ci1033
3.3.1
4.0.0
4.0.0-alpha1
4.0.0-ci1002
4.0.0-ci1004
4.0.0-ci1006
4.0.0-ci1007
4.0.0-ci1014
4.0.0-ci1015
4.0.0-ci1017
4.0.0-ci1018
4.0.0-ci1019
4.0.0-ci1020
4.0.0-ci1021
4.0.0-ci1026
4.0.0-ci1031
4.0.0-ci1032
4.0.0-ci1034
4.0.0-ci1036
4.0.0-ci1038
4.0.0-ci1046
4.0.0-ci1049
4.0.0-ci1050
4.0.0-ci1051
4.0.0-ci1052
4.0.0-ci1053
4.0.0-ci1054
4.0.0-ci1056
4.0.0-ci1057
4.0.0-ci1061
4.0.1
4.0.2
4.0.3
4.0.4
4.1.0
4.1.1
4.2.0
4.2.1
5.0.0
5.0.0-beta-1
5.0.1
5.0.2
5.1.0
5.1.1
5.2.0
6.0.0
6.0.1
6.0.2
6.1.0
6.1.1
6.2.0
6.2.1
6.2.2
7.0.0
7.0.0-alpha-0001
7.0.1
8.0.0
8.1.0
8.1.1
9.0.0
Fixed in
15.1.1
16.1.1
References
Updated Sep 10, 2026 · Source: OSV.dev |
4.2.1
patch
Dependencies (23)
+ 15 more |
|
4.2.0
minor
1 CVE
CVE-2026-32933
GHSA-rvv3-g6hj-g44x
Mar 13, 2026
AutoMapper Vulnerable to Denial of Service (DoS) via Uncontrolled Recursion
7.5
/ 10
High
Network
Low
None
None
Unchanged
None
None
High
SummaryAutoMapper is vulnerable to a Denial of Service (DoS) attack. When mapping deeply nested object graphs, the library uses recursive method calls without enforcing a default maximum depth limit. This allows an attacker to provide a specially crafted object graph that exhausts the thread's stack memory, triggering a DescriptionThe vulnerability exists in the core mapping engine. When a source object contains a property of the same type (or a type that eventually points back to itself), AutoMapper recursively attempts to map each level. Because there is no default limit on how many levels deep this recursion can go, a sufficiently nested object (approximately 25,000+ levels in standard .NET environments) will exceed the stack size. Since Impact
Proof of Concept (PoC)The following C# code demonstrates the crash by creating a nested "Circular" object graph and attempting to map it: Recommended Mitigation
Affected versions
16.0.0
16.1.0
1.1.0.118
1.1.1
1.1.2
10.0.0
10.1.0
10.1.1
11.0.0
11.0.1
12.0.0
12.0.1
+ 217 more Show less
13.0.0
13.0.1
14.0.0
15.0.0
15.0.1
15.1.0
2.0.0
2.1.1
2.1.262
2.1.265
2.1.266
2.1.267
2.2.0
2.2.1
2.2.1-ci10
2.2.1-ci1000
2.2.1-ci11
2.2.1-ci15
2.2.1-ci16
2.2.1-ci17
2.2.1-ci4
2.2.1-ci5
2.2.1-ci6
2.2.1-ci7
2.2.1-ci8
2.2.1-ci9
2.2.1-ci9000
2.2.1-ci9001
2.2.1-ci9002
2.2.1-ci9003
2.2.1-ci9004
2.2.1-ci9005
2.2.1-ci9006
2.2.24-ci
2.2.25-ci
3.0.0
3.0.0-ci1026
3.0.0-ci1028
3.0.0-ci1029
3.0.0-ci1031
3.0.0-ci1032
3.0.0-ci1033
3.0.0-ci1034
3.0.0-ci1035
3.0.0-ci1036
3.0.0-ci1037
3.0.0-ci1038
3.0.0-ci1039
3.0.0-ci1040
3.0.0-ci1041
3.0.0-ci1042
3.0.0-ci1043
3.0.0-ci1053
3.1.0
3.1.0-ci1014
3.1.0-ci1016
3.1.0-ci1017
3.1.0-ci1018
3.1.0-ci1019
3.1.0-ci1020
3.1.0-ci1021
3.1.0-ci1022
3.1.0-ci1023
3.1.0-ci1024
3.1.0-ci1026
3.1.0-ci1027
3.1.0-ci1032
3.1.0-ci1033
3.1.0-ci1034
3.1.0-ci1035
3.1.0-ci1036
3.1.0-ci1037
3.1.0-ci1038
3.1.0-ci1043
3.1.0-ci1044
3.1.0-ci1045
3.1.0-ci1046
3.1.0-ci1047
3.1.0-ci1048
3.1.0-ci1049
3.1.0-ci1050
3.1.0-ci1051
3.1.0-ci1053
3.1.0-ci1056
3.1.0-ci1058
3.1.1
3.1.1-ci1000
3.1.1-ci1003
3.2.0
3.2.0-ci1000
3.2.0-ci1001
3.2.0-ci1002
3.2.0-ci1003
3.2.0-ci1004
3.2.0-ci1005
3.2.0-ci1008
3.2.0-ci1009
3.2.0-ci1010
3.2.0-ci1011
3.2.0-ci1014
3.2.0-ci1015
3.2.0-ci1016
3.2.0-ci1017
3.2.0-ci1021
3.2.0-ci1022
3.2.0-ci1023
3.2.0-ci1024
3.2.0-ci1025
3.2.0-ci1026
3.2.0-ci1027
3.2.0-ci1028
3.2.0-ci1029
3.2.0-ci1030
3.2.0-ci1033
3.2.0-ci1034
3.2.0-ci1035
3.2.0-ci1036
3.2.0-ci1037
3.2.0-ci1038
3.2.0-ci1039
3.2.0-ci1040
3.2.0-ci1041
3.2.0-ci1042
3.2.0-ci1043
3.2.1
3.2.1-ci1000
3.2.1-ci1001
3.2.1-ci1002
3.3.0
3.3.0-ci1000
3.3.0-ci1001
3.3.0-ci1002
3.3.0-ci1003
3.3.0-ci1004
3.3.0-ci1005
3.3.0-ci1006
3.3.0-ci1007
3.3.0-ci1008
3.3.0-ci1009
3.3.0-ci1016
3.3.0-ci1017
3.3.0-ci1018
3.3.0-ci1019
3.3.0-ci1020
3.3.0-ci1021
3.3.0-ci1022
3.3.0-ci1023
3.3.0-ci1024
3.3.0-ci1025
3.3.0-ci1026
3.3.0-ci1027
3.3.0-ci1028
3.3.0-ci1029
3.3.0-ci1030
3.3.0-ci1031
3.3.0-ci1032
3.3.0-ci1033
3.3.1
4.0.0
4.0.0-alpha1
4.0.0-ci1002
4.0.0-ci1004
4.0.0-ci1006
4.0.0-ci1007
4.0.0-ci1014
4.0.0-ci1015
4.0.0-ci1017
4.0.0-ci1018
4.0.0-ci1019
4.0.0-ci1020
4.0.0-ci1021
4.0.0-ci1026
4.0.0-ci1031
4.0.0-ci1032
4.0.0-ci1034
4.0.0-ci1036
4.0.0-ci1038
4.0.0-ci1046
4.0.0-ci1049
4.0.0-ci1050
4.0.0-ci1051
4.0.0-ci1052
4.0.0-ci1053
4.0.0-ci1054
4.0.0-ci1056
4.0.0-ci1057
4.0.0-ci1061
4.0.1
4.0.2
4.0.3
4.0.4
4.1.0
4.1.1
4.2.0
4.2.1
5.0.0
5.0.0-beta-1
5.0.1
5.0.2
5.1.0
5.1.1
5.2.0
6.0.0
6.0.1
6.0.2
6.1.0
6.1.1
6.2.0
6.2.1
6.2.2
7.0.0
7.0.0-alpha-0001
7.0.1
8.0.0
8.1.0
8.1.1
9.0.0
Fixed in
15.1.1
16.1.1
References
Updated Sep 10, 2026 · Source: OSV.dev |
4.2.0
minor
Dependencies (23)
+ 15 more |
|
4.1.1
minor
1 CVE
CVE-2026-32933
GHSA-rvv3-g6hj-g44x
Mar 13, 2026
AutoMapper Vulnerable to Denial of Service (DoS) via Uncontrolled Recursion
7.5
/ 10
High
Network
Low
None
None
Unchanged
None
None
High
SummaryAutoMapper is vulnerable to a Denial of Service (DoS) attack. When mapping deeply nested object graphs, the library uses recursive method calls without enforcing a default maximum depth limit. This allows an attacker to provide a specially crafted object graph that exhausts the thread's stack memory, triggering a DescriptionThe vulnerability exists in the core mapping engine. When a source object contains a property of the same type (or a type that eventually points back to itself), AutoMapper recursively attempts to map each level. Because there is no default limit on how many levels deep this recursion can go, a sufficiently nested object (approximately 25,000+ levels in standard .NET environments) will exceed the stack size. Since Impact
Proof of Concept (PoC)The following C# code demonstrates the crash by creating a nested "Circular" object graph and attempting to map it: Recommended Mitigation
Affected versions
16.0.0
16.1.0
1.1.0.118
1.1.1
1.1.2
10.0.0
10.1.0
10.1.1
11.0.0
11.0.1
12.0.0
12.0.1
+ 217 more Show less
13.0.0
13.0.1
14.0.0
15.0.0
15.0.1
15.1.0
2.0.0
2.1.1
2.1.262
2.1.265
2.1.266
2.1.267
2.2.0
2.2.1
2.2.1-ci10
2.2.1-ci1000
2.2.1-ci11
2.2.1-ci15
2.2.1-ci16
2.2.1-ci17
2.2.1-ci4
2.2.1-ci5
2.2.1-ci6
2.2.1-ci7
2.2.1-ci8
2.2.1-ci9
2.2.1-ci9000
2.2.1-ci9001
2.2.1-ci9002
2.2.1-ci9003
2.2.1-ci9004
2.2.1-ci9005
2.2.1-ci9006
2.2.24-ci
2.2.25-ci
3.0.0
3.0.0-ci1026
3.0.0-ci1028
3.0.0-ci1029
3.0.0-ci1031
3.0.0-ci1032
3.0.0-ci1033
3.0.0-ci1034
3.0.0-ci1035
3.0.0-ci1036
3.0.0-ci1037
3.0.0-ci1038
3.0.0-ci1039
3.0.0-ci1040
3.0.0-ci1041
3.0.0-ci1042
3.0.0-ci1043
3.0.0-ci1053
3.1.0
3.1.0-ci1014
3.1.0-ci1016
3.1.0-ci1017
3.1.0-ci1018
3.1.0-ci1019
3.1.0-ci1020
3.1.0-ci1021
3.1.0-ci1022
3.1.0-ci1023
3.1.0-ci1024
3.1.0-ci1026
3.1.0-ci1027
3.1.0-ci1032
3.1.0-ci1033
3.1.0-ci1034
3.1.0-ci1035
3.1.0-ci1036
3.1.0-ci1037
3.1.0-ci1038
3.1.0-ci1043
3.1.0-ci1044
3.1.0-ci1045
3.1.0-ci1046
3.1.0-ci1047
3.1.0-ci1048
3.1.0-ci1049
3.1.0-ci1050
3.1.0-ci1051
3.1.0-ci1053
3.1.0-ci1056
3.1.0-ci1058
3.1.1
3.1.1-ci1000
3.1.1-ci1003
3.2.0
3.2.0-ci1000
3.2.0-ci1001
3.2.0-ci1002
3.2.0-ci1003
3.2.0-ci1004
3.2.0-ci1005
3.2.0-ci1008
3.2.0-ci1009
3.2.0-ci1010
3.2.0-ci1011
3.2.0-ci1014
3.2.0-ci1015
3.2.0-ci1016
3.2.0-ci1017
3.2.0-ci1021
3.2.0-ci1022
3.2.0-ci1023
3.2.0-ci1024
3.2.0-ci1025
3.2.0-ci1026
3.2.0-ci1027
3.2.0-ci1028
3.2.0-ci1029
3.2.0-ci1030
3.2.0-ci1033
3.2.0-ci1034
3.2.0-ci1035
3.2.0-ci1036
3.2.0-ci1037
3.2.0-ci1038
3.2.0-ci1039
3.2.0-ci1040
3.2.0-ci1041
3.2.0-ci1042
3.2.0-ci1043
3.2.1
3.2.1-ci1000
3.2.1-ci1001
3.2.1-ci1002
3.3.0
3.3.0-ci1000
3.3.0-ci1001
3.3.0-ci1002
3.3.0-ci1003
3.3.0-ci1004
3.3.0-ci1005
3.3.0-ci1006
3.3.0-ci1007
3.3.0-ci1008
3.3.0-ci1009
3.3.0-ci1016
3.3.0-ci1017
3.3.0-ci1018
3.3.0-ci1019
3.3.0-ci1020
3.3.0-ci1021
3.3.0-ci1022
3.3.0-ci1023
3.3.0-ci1024
3.3.0-ci1025
3.3.0-ci1026
3.3.0-ci1027
3.3.0-ci1028
3.3.0-ci1029
3.3.0-ci1030
3.3.0-ci1031
3.3.0-ci1032
3.3.0-ci1033
3.3.1
4.0.0
4.0.0-alpha1
4.0.0-ci1002
4.0.0-ci1004
4.0.0-ci1006
4.0.0-ci1007
4.0.0-ci1014
4.0.0-ci1015
4.0.0-ci1017
4.0.0-ci1018
4.0.0-ci1019
4.0.0-ci1020
4.0.0-ci1021
4.0.0-ci1026
4.0.0-ci1031
4.0.0-ci1032
4.0.0-ci1034
4.0.0-ci1036
4.0.0-ci1038
4.0.0-ci1046
4.0.0-ci1049
4.0.0-ci1050
4.0.0-ci1051
4.0.0-ci1052
4.0.0-ci1053
4.0.0-ci1054
4.0.0-ci1056
4.0.0-ci1057
4.0.0-ci1061
4.0.1
4.0.2
4.0.3
4.0.4
4.1.0
4.1.1
4.2.0
4.2.1
5.0.0
5.0.0-beta-1
5.0.1
5.0.2
5.1.0
5.1.1
5.2.0
6.0.0
6.0.1
6.0.2
6.1.0
6.1.1
6.2.0
6.2.1
6.2.2
7.0.0
7.0.0-alpha-0001
7.0.1
8.0.0
8.1.0
8.1.1
9.0.0
Fixed in
15.1.1
16.1.1
References
Updated Sep 10, 2026 · Source: OSV.dev |
4.1.1
minor
Dependencies (18)
+ 10 more |
|
4.0.4
major
1 CVE
CVE-2026-32933
GHSA-rvv3-g6hj-g44x
Mar 13, 2026
AutoMapper Vulnerable to Denial of Service (DoS) via Uncontrolled Recursion
7.5
/ 10
High
Network
Low
None
None
Unchanged
None
None
High
SummaryAutoMapper is vulnerable to a Denial of Service (DoS) attack. When mapping deeply nested object graphs, the library uses recursive method calls without enforcing a default maximum depth limit. This allows an attacker to provide a specially crafted object graph that exhausts the thread's stack memory, triggering a DescriptionThe vulnerability exists in the core mapping engine. When a source object contains a property of the same type (or a type that eventually points back to itself), AutoMapper recursively attempts to map each level. Because there is no default limit on how many levels deep this recursion can go, a sufficiently nested object (approximately 25,000+ levels in standard .NET environments) will exceed the stack size. Since Impact
Proof of Concept (PoC)The following C# code demonstrates the crash by creating a nested "Circular" object graph and attempting to map it: Recommended Mitigation
Affected versions
16.0.0
16.1.0
1.1.0.118
1.1.1
1.1.2
10.0.0
10.1.0
10.1.1
11.0.0
11.0.1
12.0.0
12.0.1
+ 217 more Show less
13.0.0
13.0.1
14.0.0
15.0.0
15.0.1
15.1.0
2.0.0
2.1.1
2.1.262
2.1.265
2.1.266
2.1.267
2.2.0
2.2.1
2.2.1-ci10
2.2.1-ci1000
2.2.1-ci11
2.2.1-ci15
2.2.1-ci16
2.2.1-ci17
2.2.1-ci4
2.2.1-ci5
2.2.1-ci6
2.2.1-ci7
2.2.1-ci8
2.2.1-ci9
2.2.1-ci9000
2.2.1-ci9001
2.2.1-ci9002
2.2.1-ci9003
2.2.1-ci9004
2.2.1-ci9005
2.2.1-ci9006
2.2.24-ci
2.2.25-ci
3.0.0
3.0.0-ci1026
3.0.0-ci1028
3.0.0-ci1029
3.0.0-ci1031
3.0.0-ci1032
3.0.0-ci1033
3.0.0-ci1034
3.0.0-ci1035
3.0.0-ci1036
3.0.0-ci1037
3.0.0-ci1038
3.0.0-ci1039
3.0.0-ci1040
3.0.0-ci1041
3.0.0-ci1042
3.0.0-ci1043
3.0.0-ci1053
3.1.0
3.1.0-ci1014
3.1.0-ci1016
3.1.0-ci1017
3.1.0-ci1018
3.1.0-ci1019
3.1.0-ci1020
3.1.0-ci1021
3.1.0-ci1022
3.1.0-ci1023
3.1.0-ci1024
3.1.0-ci1026
3.1.0-ci1027
3.1.0-ci1032
3.1.0-ci1033
3.1.0-ci1034
3.1.0-ci1035
3.1.0-ci1036
3.1.0-ci1037
3.1.0-ci1038
3.1.0-ci1043
3.1.0-ci1044
3.1.0-ci1045
3.1.0-ci1046
3.1.0-ci1047
3.1.0-ci1048
3.1.0-ci1049
3.1.0-ci1050
3.1.0-ci1051
3.1.0-ci1053
3.1.0-ci1056
3.1.0-ci1058
3.1.1
3.1.1-ci1000
3.1.1-ci1003
3.2.0
3.2.0-ci1000
3.2.0-ci1001
3.2.0-ci1002
3.2.0-ci1003
3.2.0-ci1004
3.2.0-ci1005
3.2.0-ci1008
3.2.0-ci1009
3.2.0-ci1010
3.2.0-ci1011
3.2.0-ci1014
3.2.0-ci1015
3.2.0-ci1016
3.2.0-ci1017
3.2.0-ci1021
3.2.0-ci1022
3.2.0-ci1023
3.2.0-ci1024
3.2.0-ci1025
3.2.0-ci1026
3.2.0-ci1027
3.2.0-ci1028
3.2.0-ci1029
3.2.0-ci1030
3.2.0-ci1033
3.2.0-ci1034
3.2.0-ci1035
3.2.0-ci1036
3.2.0-ci1037
3.2.0-ci1038
3.2.0-ci1039
3.2.0-ci1040
3.2.0-ci1041
3.2.0-ci1042
3.2.0-ci1043
3.2.1
3.2.1-ci1000
3.2.1-ci1001
3.2.1-ci1002
3.3.0
3.3.0-ci1000
3.3.0-ci1001
3.3.0-ci1002
3.3.0-ci1003
3.3.0-ci1004
3.3.0-ci1005
3.3.0-ci1006
3.3.0-ci1007
3.3.0-ci1008
3.3.0-ci1009
3.3.0-ci1016
3.3.0-ci1017
3.3.0-ci1018
3.3.0-ci1019
3.3.0-ci1020
3.3.0-ci1021
3.3.0-ci1022
3.3.0-ci1023
3.3.0-ci1024
3.3.0-ci1025
3.3.0-ci1026
3.3.0-ci1027
3.3.0-ci1028
3.3.0-ci1029
3.3.0-ci1030
3.3.0-ci1031
3.3.0-ci1032
3.3.0-ci1033
3.3.1
4.0.0
4.0.0-alpha1
4.0.0-ci1002
4.0.0-ci1004
4.0.0-ci1006
4.0.0-ci1007
4.0.0-ci1014
4.0.0-ci1015
4.0.0-ci1017
4.0.0-ci1018
4.0.0-ci1019
4.0.0-ci1020
4.0.0-ci1021
4.0.0-ci1026
4.0.0-ci1031
4.0.0-ci1032
4.0.0-ci1034
4.0.0-ci1036
4.0.0-ci1038
4.0.0-ci1046
4.0.0-ci1049
4.0.0-ci1050
4.0.0-ci1051
4.0.0-ci1052
4.0.0-ci1053
4.0.0-ci1054
4.0.0-ci1056
4.0.0-ci1057
4.0.0-ci1061
4.0.1
4.0.2
4.0.3
4.0.4
4.1.0
4.1.1
4.2.0
4.2.1
5.0.0
5.0.0-beta-1
5.0.1
5.0.2
5.1.0
5.1.1
5.2.0
6.0.0
6.0.1
6.0.2
6.1.0
6.1.1
6.2.0
6.2.1
6.2.2
7.0.0
7.0.0-alpha-0001
7.0.1
8.0.0
8.1.0
8.1.1
9.0.0
Fixed in
15.1.1
16.1.1
References
Updated Sep 10, 2026 · Source: OSV.dev |
4.0.4
major
Dependencies (16)
+ 8 more |
|
4.0.0-alpha1
pre
1 CVE
CVE-2026-32933
GHSA-rvv3-g6hj-g44x
Mar 13, 2026
AutoMapper Vulnerable to Denial of Service (DoS) via Uncontrolled Recursion
7.5
/ 10
High
Network
Low
None
None
Unchanged
None
None
High
SummaryAutoMapper is vulnerable to a Denial of Service (DoS) attack. When mapping deeply nested object graphs, the library uses recursive method calls without enforcing a default maximum depth limit. This allows an attacker to provide a specially crafted object graph that exhausts the thread's stack memory, triggering a DescriptionThe vulnerability exists in the core mapping engine. When a source object contains a property of the same type (or a type that eventually points back to itself), AutoMapper recursively attempts to map each level. Because there is no default limit on how many levels deep this recursion can go, a sufficiently nested object (approximately 25,000+ levels in standard .NET environments) will exceed the stack size. Since Impact
Proof of Concept (PoC)The following C# code demonstrates the crash by creating a nested "Circular" object graph and attempting to map it: Recommended Mitigation
Affected versions
16.0.0
16.1.0
1.1.0.118
1.1.1
1.1.2
10.0.0
10.1.0
10.1.1
11.0.0
11.0.1
12.0.0
12.0.1
+ 217 more Show less
13.0.0
13.0.1
14.0.0
15.0.0
15.0.1
15.1.0
2.0.0
2.1.1
2.1.262
2.1.265
2.1.266
2.1.267
2.2.0
2.2.1
2.2.1-ci10
2.2.1-ci1000
2.2.1-ci11
2.2.1-ci15
2.2.1-ci16
2.2.1-ci17
2.2.1-ci4
2.2.1-ci5
2.2.1-ci6
2.2.1-ci7
2.2.1-ci8
2.2.1-ci9
2.2.1-ci9000
2.2.1-ci9001
2.2.1-ci9002
2.2.1-ci9003
2.2.1-ci9004
2.2.1-ci9005
2.2.1-ci9006
2.2.24-ci
2.2.25-ci
3.0.0
3.0.0-ci1026
3.0.0-ci1028
3.0.0-ci1029
3.0.0-ci1031
3.0.0-ci1032
3.0.0-ci1033
3.0.0-ci1034
3.0.0-ci1035
3.0.0-ci1036
3.0.0-ci1037
3.0.0-ci1038
3.0.0-ci1039
3.0.0-ci1040
3.0.0-ci1041
3.0.0-ci1042
3.0.0-ci1043
3.0.0-ci1053
3.1.0
3.1.0-ci1014
3.1.0-ci1016
3.1.0-ci1017
3.1.0-ci1018
3.1.0-ci1019
3.1.0-ci1020
3.1.0-ci1021
3.1.0-ci1022
3.1.0-ci1023
3.1.0-ci1024
3.1.0-ci1026
3.1.0-ci1027
3.1.0-ci1032
3.1.0-ci1033
3.1.0-ci1034
3.1.0-ci1035
3.1.0-ci1036
3.1.0-ci1037
3.1.0-ci1038
3.1.0-ci1043
3.1.0-ci1044
3.1.0-ci1045
3.1.0-ci1046
3.1.0-ci1047
3.1.0-ci1048
3.1.0-ci1049
3.1.0-ci1050
3.1.0-ci1051
3.1.0-ci1053
3.1.0-ci1056
3.1.0-ci1058
3.1.1
3.1.1-ci1000
3.1.1-ci1003
3.2.0
3.2.0-ci1000
3.2.0-ci1001
3.2.0-ci1002
3.2.0-ci1003
3.2.0-ci1004
3.2.0-ci1005
3.2.0-ci1008
3.2.0-ci1009
3.2.0-ci1010
3.2.0-ci1011
3.2.0-ci1014
3.2.0-ci1015
3.2.0-ci1016
3.2.0-ci1017
3.2.0-ci1021
3.2.0-ci1022
3.2.0-ci1023
3.2.0-ci1024
3.2.0-ci1025
3.2.0-ci1026
3.2.0-ci1027
3.2.0-ci1028
3.2.0-ci1029
3.2.0-ci1030
3.2.0-ci1033
3.2.0-ci1034
3.2.0-ci1035
3.2.0-ci1036
3.2.0-ci1037
3.2.0-ci1038
3.2.0-ci1039
3.2.0-ci1040
3.2.0-ci1041
3.2.0-ci1042
3.2.0-ci1043
3.2.1
3.2.1-ci1000
3.2.1-ci1001
3.2.1-ci1002
3.3.0
3.3.0-ci1000
3.3.0-ci1001
3.3.0-ci1002
3.3.0-ci1003
3.3.0-ci1004
3.3.0-ci1005
3.3.0-ci1006
3.3.0-ci1007
3.3.0-ci1008
3.3.0-ci1009
3.3.0-ci1016
3.3.0-ci1017
3.3.0-ci1018
3.3.0-ci1019
3.3.0-ci1020
3.3.0-ci1021
3.3.0-ci1022
3.3.0-ci1023
3.3.0-ci1024
3.3.0-ci1025
3.3.0-ci1026
3.3.0-ci1027
3.3.0-ci1028
3.3.0-ci1029
3.3.0-ci1030
3.3.0-ci1031
3.3.0-ci1032
3.3.0-ci1033
3.3.1
4.0.0
4.0.0-alpha1
4.0.0-ci1002
4.0.0-ci1004
4.0.0-ci1006
4.0.0-ci1007
4.0.0-ci1014
4.0.0-ci1015
4.0.0-ci1017
4.0.0-ci1018
4.0.0-ci1019
4.0.0-ci1020
4.0.0-ci1021
4.0.0-ci1026
4.0.0-ci1031
4.0.0-ci1032
4.0.0-ci1034
4.0.0-ci1036
4.0.0-ci1038
4.0.0-ci1046
4.0.0-ci1049
4.0.0-ci1050
4.0.0-ci1051
4.0.0-ci1052
4.0.0-ci1053
4.0.0-ci1054
4.0.0-ci1056
4.0.0-ci1057
4.0.0-ci1061
4.0.1
4.0.2
4.0.3
4.0.4
4.1.0
4.1.1
4.2.0
4.2.1
5.0.0
5.0.0-beta-1
5.0.1
5.0.2
5.1.0
5.1.1
5.2.0
6.0.0
6.0.1
6.0.2
6.1.0
6.1.1
6.2.0
6.2.1
6.2.2
7.0.0
7.0.0-alpha-0001
7.0.1
8.0.0
8.1.0
8.1.1
9.0.0
Fixed in
15.1.1
16.1.1
References
Updated Sep 10, 2026 · Source: OSV.dev |
4.0.0-alpha1
pre
Dependencies (15)
+ 7 more |
|
3.3.1
patch
1 CVE
CVE-2026-32933
GHSA-rvv3-g6hj-g44x
Mar 13, 2026
AutoMapper Vulnerable to Denial of Service (DoS) via Uncontrolled Recursion
7.5
/ 10
High
Network
Low
None
None
Unchanged
None
None
High
SummaryAutoMapper is vulnerable to a Denial of Service (DoS) attack. When mapping deeply nested object graphs, the library uses recursive method calls without enforcing a default maximum depth limit. This allows an attacker to provide a specially crafted object graph that exhausts the thread's stack memory, triggering a DescriptionThe vulnerability exists in the core mapping engine. When a source object contains a property of the same type (or a type that eventually points back to itself), AutoMapper recursively attempts to map each level. Because there is no default limit on how many levels deep this recursion can go, a sufficiently nested object (approximately 25,000+ levels in standard .NET environments) will exceed the stack size. Since Impact
Proof of Concept (PoC)The following C# code demonstrates the crash by creating a nested "Circular" object graph and attempting to map it: Recommended Mitigation
Affected versions
16.0.0
16.1.0
1.1.0.118
1.1.1
1.1.2
10.0.0
10.1.0
10.1.1
11.0.0
11.0.1
12.0.0
12.0.1
+ 217 more Show less
13.0.0
13.0.1
14.0.0
15.0.0
15.0.1
15.1.0
2.0.0
2.1.1
2.1.262
2.1.265
2.1.266
2.1.267
2.2.0
2.2.1
2.2.1-ci10
2.2.1-ci1000
2.2.1-ci11
2.2.1-ci15
2.2.1-ci16
2.2.1-ci17
2.2.1-ci4
2.2.1-ci5
2.2.1-ci6
2.2.1-ci7
2.2.1-ci8
2.2.1-ci9
2.2.1-ci9000
2.2.1-ci9001
2.2.1-ci9002
2.2.1-ci9003
2.2.1-ci9004
2.2.1-ci9005
2.2.1-ci9006
2.2.24-ci
2.2.25-ci
3.0.0
3.0.0-ci1026
3.0.0-ci1028
3.0.0-ci1029
3.0.0-ci1031
3.0.0-ci1032
3.0.0-ci1033
3.0.0-ci1034
3.0.0-ci1035
3.0.0-ci1036
3.0.0-ci1037
3.0.0-ci1038
3.0.0-ci1039
3.0.0-ci1040
3.0.0-ci1041
3.0.0-ci1042
3.0.0-ci1043
3.0.0-ci1053
3.1.0
3.1.0-ci1014
3.1.0-ci1016
3.1.0-ci1017
3.1.0-ci1018
3.1.0-ci1019
3.1.0-ci1020
3.1.0-ci1021
3.1.0-ci1022
3.1.0-ci1023
3.1.0-ci1024
3.1.0-ci1026
3.1.0-ci1027
3.1.0-ci1032
3.1.0-ci1033
3.1.0-ci1034
3.1.0-ci1035
3.1.0-ci1036
3.1.0-ci1037
3.1.0-ci1038
3.1.0-ci1043
3.1.0-ci1044
3.1.0-ci1045
3.1.0-ci1046
3.1.0-ci1047
3.1.0-ci1048
3.1.0-ci1049
3.1.0-ci1050
3.1.0-ci1051
3.1.0-ci1053
3.1.0-ci1056
3.1.0-ci1058
3.1.1
3.1.1-ci1000
3.1.1-ci1003
3.2.0
3.2.0-ci1000
3.2.0-ci1001
3.2.0-ci1002
3.2.0-ci1003
3.2.0-ci1004
3.2.0-ci1005
3.2.0-ci1008
3.2.0-ci1009
3.2.0-ci1010
3.2.0-ci1011
3.2.0-ci1014
3.2.0-ci1015
3.2.0-ci1016
3.2.0-ci1017
3.2.0-ci1021
3.2.0-ci1022
3.2.0-ci1023
3.2.0-ci1024
3.2.0-ci1025
3.2.0-ci1026
3.2.0-ci1027
3.2.0-ci1028
3.2.0-ci1029
3.2.0-ci1030
3.2.0-ci1033
3.2.0-ci1034
3.2.0-ci1035
3.2.0-ci1036
3.2.0-ci1037
3.2.0-ci1038
3.2.0-ci1039
3.2.0-ci1040
3.2.0-ci1041
3.2.0-ci1042
3.2.0-ci1043
3.2.1
3.2.1-ci1000
3.2.1-ci1001
3.2.1-ci1002
3.3.0
3.3.0-ci1000
3.3.0-ci1001
3.3.0-ci1002
3.3.0-ci1003
3.3.0-ci1004
3.3.0-ci1005
3.3.0-ci1006
3.3.0-ci1007
3.3.0-ci1008
3.3.0-ci1009
3.3.0-ci1016
3.3.0-ci1017
3.3.0-ci1018
3.3.0-ci1019
3.3.0-ci1020
3.3.0-ci1021
3.3.0-ci1022
3.3.0-ci1023
3.3.0-ci1024
3.3.0-ci1025
3.3.0-ci1026
3.3.0-ci1027
3.3.0-ci1028
3.3.0-ci1029
3.3.0-ci1030
3.3.0-ci1031
3.3.0-ci1032
3.3.0-ci1033
3.3.1
4.0.0
4.0.0-alpha1
4.0.0-ci1002
4.0.0-ci1004
4.0.0-ci1006
4.0.0-ci1007
4.0.0-ci1014
4.0.0-ci1015
4.0.0-ci1017
4.0.0-ci1018
4.0.0-ci1019
4.0.0-ci1020
4.0.0-ci1021
4.0.0-ci1026
4.0.0-ci1031
4.0.0-ci1032
4.0.0-ci1034
4.0.0-ci1036
4.0.0-ci1038
4.0.0-ci1046
4.0.0-ci1049
4.0.0-ci1050
4.0.0-ci1051
4.0.0-ci1052
4.0.0-ci1053
4.0.0-ci1054
4.0.0-ci1056
4.0.0-ci1057
4.0.0-ci1061
4.0.1
4.0.2
4.0.3
4.0.4
4.1.0
4.1.1
4.2.0
4.2.1
5.0.0
5.0.0-beta-1
5.0.1
5.0.2
5.1.0
5.1.1
5.2.0
6.0.0
6.0.1
6.0.2
6.1.0
6.1.1
6.2.0
6.2.1
6.2.2
7.0.0
7.0.0-alpha-0001
7.0.1
8.0.0
8.1.0
8.1.1
9.0.0
Fixed in
15.1.1
16.1.1
References
Updated Sep 10, 2026 · Source: OSV.dev |
3.3.1
patch
|
|
3.3.0
minor
1 CVE
CVE-2026-32933
GHSA-rvv3-g6hj-g44x
Mar 13, 2026
AutoMapper Vulnerable to Denial of Service (DoS) via Uncontrolled Recursion
7.5
/ 10
High
Network
Low
None
None
Unchanged
None
None
High
SummaryAutoMapper is vulnerable to a Denial of Service (DoS) attack. When mapping deeply nested object graphs, the library uses recursive method calls without enforcing a default maximum depth limit. This allows an attacker to provide a specially crafted object graph that exhausts the thread's stack memory, triggering a DescriptionThe vulnerability exists in the core mapping engine. When a source object contains a property of the same type (or a type that eventually points back to itself), AutoMapper recursively attempts to map each level. Because there is no default limit on how many levels deep this recursion can go, a sufficiently nested object (approximately 25,000+ levels in standard .NET environments) will exceed the stack size. Since Impact
Proof of Concept (PoC)The following C# code demonstrates the crash by creating a nested "Circular" object graph and attempting to map it: Recommended Mitigation
Affected versions
16.0.0
16.1.0
1.1.0.118
1.1.1
1.1.2
10.0.0
10.1.0
10.1.1
11.0.0
11.0.1
12.0.0
12.0.1
+ 217 more Show less
13.0.0
13.0.1
14.0.0
15.0.0
15.0.1
15.1.0
2.0.0
2.1.1
2.1.262
2.1.265
2.1.266
2.1.267
2.2.0
2.2.1
2.2.1-ci10
2.2.1-ci1000
2.2.1-ci11
2.2.1-ci15
2.2.1-ci16
2.2.1-ci17
2.2.1-ci4
2.2.1-ci5
2.2.1-ci6
2.2.1-ci7
2.2.1-ci8
2.2.1-ci9
2.2.1-ci9000
2.2.1-ci9001
2.2.1-ci9002
2.2.1-ci9003
2.2.1-ci9004
2.2.1-ci9005
2.2.1-ci9006
2.2.24-ci
2.2.25-ci
3.0.0
3.0.0-ci1026
3.0.0-ci1028
3.0.0-ci1029
3.0.0-ci1031
3.0.0-ci1032
3.0.0-ci1033
3.0.0-ci1034
3.0.0-ci1035
3.0.0-ci1036
3.0.0-ci1037
3.0.0-ci1038
3.0.0-ci1039
3.0.0-ci1040
3.0.0-ci1041
3.0.0-ci1042
3.0.0-ci1043
3.0.0-ci1053
3.1.0
3.1.0-ci1014
3.1.0-ci1016
3.1.0-ci1017
3.1.0-ci1018
3.1.0-ci1019
3.1.0-ci1020
3.1.0-ci1021
3.1.0-ci1022
3.1.0-ci1023
3.1.0-ci1024
3.1.0-ci1026
3.1.0-ci1027
3.1.0-ci1032
3.1.0-ci1033
3.1.0-ci1034
3.1.0-ci1035
3.1.0-ci1036
3.1.0-ci1037
3.1.0-ci1038
3.1.0-ci1043
3.1.0-ci1044
3.1.0-ci1045
3.1.0-ci1046
3.1.0-ci1047
3.1.0-ci1048
3.1.0-ci1049
3.1.0-ci1050
3.1.0-ci1051
3.1.0-ci1053
3.1.0-ci1056
3.1.0-ci1058
3.1.1
3.1.1-ci1000
3.1.1-ci1003
3.2.0
3.2.0-ci1000
3.2.0-ci1001
3.2.0-ci1002
3.2.0-ci1003
3.2.0-ci1004
3.2.0-ci1005
3.2.0-ci1008
3.2.0-ci1009
3.2.0-ci1010
3.2.0-ci1011
3.2.0-ci1014
3.2.0-ci1015
3.2.0-ci1016
3.2.0-ci1017
3.2.0-ci1021
3.2.0-ci1022
3.2.0-ci1023
3.2.0-ci1024
3.2.0-ci1025
3.2.0-ci1026
3.2.0-ci1027
3.2.0-ci1028
3.2.0-ci1029
3.2.0-ci1030
3.2.0-ci1033
3.2.0-ci1034
3.2.0-ci1035
3.2.0-ci1036
3.2.0-ci1037
3.2.0-ci1038
3.2.0-ci1039
3.2.0-ci1040
3.2.0-ci1041
3.2.0-ci1042
3.2.0-ci1043
3.2.1
3.2.1-ci1000
3.2.1-ci1001
3.2.1-ci1002
3.3.0
3.3.0-ci1000
3.3.0-ci1001
3.3.0-ci1002
3.3.0-ci1003
3.3.0-ci1004
3.3.0-ci1005
3.3.0-ci1006
3.3.0-ci1007
3.3.0-ci1008
3.3.0-ci1009
3.3.0-ci1016
3.3.0-ci1017
3.3.0-ci1018
3.3.0-ci1019
3.3.0-ci1020
3.3.0-ci1021
3.3.0-ci1022
3.3.0-ci1023
3.3.0-ci1024
3.3.0-ci1025
3.3.0-ci1026
3.3.0-ci1027
3.3.0-ci1028
3.3.0-ci1029
3.3.0-ci1030
3.3.0-ci1031
3.3.0-ci1032
3.3.0-ci1033
3.3.1
4.0.0
4.0.0-alpha1
4.0.0-ci1002
4.0.0-ci1004
4.0.0-ci1006
4.0.0-ci1007
4.0.0-ci1014
4.0.0-ci1015
4.0.0-ci1017
4.0.0-ci1018
4.0.0-ci1019
4.0.0-ci1020
4.0.0-ci1021
4.0.0-ci1026
4.0.0-ci1031
4.0.0-ci1032
4.0.0-ci1034
4.0.0-ci1036
4.0.0-ci1038
4.0.0-ci1046
4.0.0-ci1049
4.0.0-ci1050
4.0.0-ci1051
4.0.0-ci1052
4.0.0-ci1053
4.0.0-ci1054
4.0.0-ci1056
4.0.0-ci1057
4.0.0-ci1061
4.0.1
4.0.2
4.0.3
4.0.4
4.1.0
4.1.1
4.2.0
4.2.1
5.0.0
5.0.0-beta-1
5.0.1
5.0.2
5.1.0
5.1.1
5.2.0
6.0.0
6.0.1
6.0.2
6.1.0
6.1.1
6.2.0
6.2.1
6.2.2
7.0.0
7.0.0-alpha-0001
7.0.1
8.0.0
8.1.0
8.1.1
9.0.0
Fixed in
15.1.1
16.1.1
References
Updated Sep 10, 2026 · Source: OSV.dev |
3.3.0
minor
|
|
3.2.1
minor
1 CVE
CVE-2026-32933
GHSA-rvv3-g6hj-g44x
Mar 13, 2026
AutoMapper Vulnerable to Denial of Service (DoS) via Uncontrolled Recursion
7.5
/ 10
High
Network
Low
None
None
Unchanged
None
None
High
SummaryAutoMapper is vulnerable to a Denial of Service (DoS) attack. When mapping deeply nested object graphs, the library uses recursive method calls without enforcing a default maximum depth limit. This allows an attacker to provide a specially crafted object graph that exhausts the thread's stack memory, triggering a DescriptionThe vulnerability exists in the core mapping engine. When a source object contains a property of the same type (or a type that eventually points back to itself), AutoMapper recursively attempts to map each level. Because there is no default limit on how many levels deep this recursion can go, a sufficiently nested object (approximately 25,000+ levels in standard .NET environments) will exceed the stack size. Since Impact
Proof of Concept (PoC)The following C# code demonstrates the crash by creating a nested "Circular" object graph and attempting to map it: Recommended Mitigation
Affected versions
16.0.0
16.1.0
1.1.0.118
1.1.1
1.1.2
10.0.0
10.1.0
10.1.1
11.0.0
11.0.1
12.0.0
12.0.1
+ 217 more Show less
13.0.0
13.0.1
14.0.0
15.0.0
15.0.1
15.1.0
2.0.0
2.1.1
2.1.262
2.1.265
2.1.266
2.1.267
2.2.0
2.2.1
2.2.1-ci10
2.2.1-ci1000
2.2.1-ci11
2.2.1-ci15
2.2.1-ci16
2.2.1-ci17
2.2.1-ci4
2.2.1-ci5
2.2.1-ci6
2.2.1-ci7
2.2.1-ci8
2.2.1-ci9
2.2.1-ci9000
2.2.1-ci9001
2.2.1-ci9002
2.2.1-ci9003
2.2.1-ci9004
2.2.1-ci9005
2.2.1-ci9006
2.2.24-ci
2.2.25-ci
3.0.0
3.0.0-ci1026
3.0.0-ci1028
3.0.0-ci1029
3.0.0-ci1031
3.0.0-ci1032
3.0.0-ci1033
3.0.0-ci1034
3.0.0-ci1035
3.0.0-ci1036
3.0.0-ci1037
3.0.0-ci1038
3.0.0-ci1039
3.0.0-ci1040
3.0.0-ci1041
3.0.0-ci1042
3.0.0-ci1043
3.0.0-ci1053
3.1.0
3.1.0-ci1014
3.1.0-ci1016
3.1.0-ci1017
3.1.0-ci1018
3.1.0-ci1019
3.1.0-ci1020
3.1.0-ci1021
3.1.0-ci1022
3.1.0-ci1023
3.1.0-ci1024
3.1.0-ci1026
3.1.0-ci1027
3.1.0-ci1032
3.1.0-ci1033
3.1.0-ci1034
3.1.0-ci1035
3.1.0-ci1036
3.1.0-ci1037
3.1.0-ci1038
3.1.0-ci1043
3.1.0-ci1044
3.1.0-ci1045
3.1.0-ci1046
3.1.0-ci1047
3.1.0-ci1048
3.1.0-ci1049
3.1.0-ci1050
3.1.0-ci1051
3.1.0-ci1053
3.1.0-ci1056
3.1.0-ci1058
3.1.1
3.1.1-ci1000
3.1.1-ci1003
3.2.0
3.2.0-ci1000
3.2.0-ci1001
3.2.0-ci1002
3.2.0-ci1003
3.2.0-ci1004
3.2.0-ci1005
3.2.0-ci1008
3.2.0-ci1009
3.2.0-ci1010
3.2.0-ci1011
3.2.0-ci1014
3.2.0-ci1015
3.2.0-ci1016
3.2.0-ci1017
3.2.0-ci1021
3.2.0-ci1022
3.2.0-ci1023
3.2.0-ci1024
3.2.0-ci1025
3.2.0-ci1026
3.2.0-ci1027
3.2.0-ci1028
3.2.0-ci1029
3.2.0-ci1030
3.2.0-ci1033
3.2.0-ci1034
3.2.0-ci1035
3.2.0-ci1036
3.2.0-ci1037
3.2.0-ci1038
3.2.0-ci1039
3.2.0-ci1040
3.2.0-ci1041
3.2.0-ci1042
3.2.0-ci1043
3.2.1
3.2.1-ci1000
3.2.1-ci1001
3.2.1-ci1002
3.3.0
3.3.0-ci1000
3.3.0-ci1001
3.3.0-ci1002
3.3.0-ci1003
3.3.0-ci1004
3.3.0-ci1005
3.3.0-ci1006
3.3.0-ci1007
3.3.0-ci1008
3.3.0-ci1009
3.3.0-ci1016
3.3.0-ci1017
3.3.0-ci1018
3.3.0-ci1019
3.3.0-ci1020
3.3.0-ci1021
3.3.0-ci1022
3.3.0-ci1023
3.3.0-ci1024
3.3.0-ci1025
3.3.0-ci1026
3.3.0-ci1027
3.3.0-ci1028
3.3.0-ci1029
3.3.0-ci1030
3.3.0-ci1031
3.3.0-ci1032
3.3.0-ci1033
3.3.1
4.0.0
4.0.0-alpha1
4.0.0-ci1002
4.0.0-ci1004
4.0.0-ci1006
4.0.0-ci1007
4.0.0-ci1014
4.0.0-ci1015
4.0.0-ci1017
4.0.0-ci1018
4.0.0-ci1019
4.0.0-ci1020
4.0.0-ci1021
4.0.0-ci1026
4.0.0-ci1031
4.0.0-ci1032
4.0.0-ci1034
4.0.0-ci1036
4.0.0-ci1038
4.0.0-ci1046
4.0.0-ci1049
4.0.0-ci1050
4.0.0-ci1051
4.0.0-ci1052
4.0.0-ci1053
4.0.0-ci1054
4.0.0-ci1056
4.0.0-ci1057
4.0.0-ci1061
4.0.1
4.0.2
4.0.3
4.0.4
4.1.0
4.1.1
4.2.0
4.2.1
5.0.0
5.0.0-beta-1
5.0.1
5.0.2
5.1.0
5.1.1
5.2.0
6.0.0
6.0.1
6.0.2
6.1.0
6.1.1
6.2.0
6.2.1
6.2.2
7.0.0
7.0.0-alpha-0001
7.0.1
8.0.0
8.1.0
8.1.1
9.0.0
Fixed in
15.1.1
16.1.1
References
Updated Sep 10, 2026 · Source: OSV.dev |
3.2.1
minor
|
|
3.1.1
patch
1 CVE
CVE-2026-32933
GHSA-rvv3-g6hj-g44x
Mar 13, 2026
AutoMapper Vulnerable to Denial of Service (DoS) via Uncontrolled Recursion
7.5
/ 10
High
Network
Low
None
None
Unchanged
None
None
High
SummaryAutoMapper is vulnerable to a Denial of Service (DoS) attack. When mapping deeply nested object graphs, the library uses recursive method calls without enforcing a default maximum depth limit. This allows an attacker to provide a specially crafted object graph that exhausts the thread's stack memory, triggering a DescriptionThe vulnerability exists in the core mapping engine. When a source object contains a property of the same type (or a type that eventually points back to itself), AutoMapper recursively attempts to map each level. Because there is no default limit on how many levels deep this recursion can go, a sufficiently nested object (approximately 25,000+ levels in standard .NET environments) will exceed the stack size. Since Impact
Proof of Concept (PoC)The following C# code demonstrates the crash by creating a nested "Circular" object graph and attempting to map it: Recommended Mitigation
Affected versions
16.0.0
16.1.0
1.1.0.118
1.1.1
1.1.2
10.0.0
10.1.0
10.1.1
11.0.0
11.0.1
12.0.0
12.0.1
+ 217 more Show less
13.0.0
13.0.1
14.0.0
15.0.0
15.0.1
15.1.0
2.0.0
2.1.1
2.1.262
2.1.265
2.1.266
2.1.267
2.2.0
2.2.1
2.2.1-ci10
2.2.1-ci1000
2.2.1-ci11
2.2.1-ci15
2.2.1-ci16
2.2.1-ci17
2.2.1-ci4
2.2.1-ci5
2.2.1-ci6
2.2.1-ci7
2.2.1-ci8
2.2.1-ci9
2.2.1-ci9000
2.2.1-ci9001
2.2.1-ci9002
2.2.1-ci9003
2.2.1-ci9004
2.2.1-ci9005
2.2.1-ci9006
2.2.24-ci
2.2.25-ci
3.0.0
3.0.0-ci1026
3.0.0-ci1028
3.0.0-ci1029
3.0.0-ci1031
3.0.0-ci1032
3.0.0-ci1033
3.0.0-ci1034
3.0.0-ci1035
3.0.0-ci1036
3.0.0-ci1037
3.0.0-ci1038
3.0.0-ci1039
3.0.0-ci1040
3.0.0-ci1041
3.0.0-ci1042
3.0.0-ci1043
3.0.0-ci1053
3.1.0
3.1.0-ci1014
3.1.0-ci1016
3.1.0-ci1017
3.1.0-ci1018
3.1.0-ci1019
3.1.0-ci1020
3.1.0-ci1021
3.1.0-ci1022
3.1.0-ci1023
3.1.0-ci1024
3.1.0-ci1026
3.1.0-ci1027
3.1.0-ci1032
3.1.0-ci1033
3.1.0-ci1034
3.1.0-ci1035
3.1.0-ci1036
3.1.0-ci1037
3.1.0-ci1038
3.1.0-ci1043
3.1.0-ci1044
3.1.0-ci1045
3.1.0-ci1046
3.1.0-ci1047
3.1.0-ci1048
3.1.0-ci1049
3.1.0-ci1050
3.1.0-ci1051
3.1.0-ci1053
3.1.0-ci1056
3.1.0-ci1058
3.1.1
3.1.1-ci1000
3.1.1-ci1003
3.2.0
3.2.0-ci1000
3.2.0-ci1001
3.2.0-ci1002
3.2.0-ci1003
3.2.0-ci1004
3.2.0-ci1005
3.2.0-ci1008
3.2.0-ci1009
3.2.0-ci1010
3.2.0-ci1011
3.2.0-ci1014
3.2.0-ci1015
3.2.0-ci1016
3.2.0-ci1017
3.2.0-ci1021
3.2.0-ci1022
3.2.0-ci1023
3.2.0-ci1024
3.2.0-ci1025
3.2.0-ci1026
3.2.0-ci1027
3.2.0-ci1028
3.2.0-ci1029
3.2.0-ci1030
3.2.0-ci1033
3.2.0-ci1034
3.2.0-ci1035
3.2.0-ci1036
3.2.0-ci1037
3.2.0-ci1038
3.2.0-ci1039
3.2.0-ci1040
3.2.0-ci1041
3.2.0-ci1042
3.2.0-ci1043
3.2.1
3.2.1-ci1000
3.2.1-ci1001
3.2.1-ci1002
3.3.0
3.3.0-ci1000
3.3.0-ci1001
3.3.0-ci1002
3.3.0-ci1003
3.3.0-ci1004
3.3.0-ci1005
3.3.0-ci1006
3.3.0-ci1007
3.3.0-ci1008
3.3.0-ci1009
3.3.0-ci1016
3.3.0-ci1017
3.3.0-ci1018
3.3.0-ci1019
3.3.0-ci1020
3.3.0-ci1021
3.3.0-ci1022
3.3.0-ci1023
3.3.0-ci1024
3.3.0-ci1025
3.3.0-ci1026
3.3.0-ci1027
3.3.0-ci1028
3.3.0-ci1029
3.3.0-ci1030
3.3.0-ci1031
3.3.0-ci1032
3.3.0-ci1033
3.3.1
4.0.0
4.0.0-alpha1
4.0.0-ci1002
4.0.0-ci1004
4.0.0-ci1006
4.0.0-ci1007
4.0.0-ci1014
4.0.0-ci1015
4.0.0-ci1017
4.0.0-ci1018
4.0.0-ci1019
4.0.0-ci1020
4.0.0-ci1021
4.0.0-ci1026
4.0.0-ci1031
4.0.0-ci1032
4.0.0-ci1034
4.0.0-ci1036
4.0.0-ci1038
4.0.0-ci1046
4.0.0-ci1049
4.0.0-ci1050
4.0.0-ci1051
4.0.0-ci1052
4.0.0-ci1053
4.0.0-ci1054
4.0.0-ci1056
4.0.0-ci1057
4.0.0-ci1061
4.0.1
4.0.2
4.0.3
4.0.4
4.1.0
4.1.1
4.2.0
4.2.1
5.0.0
5.0.0-beta-1
5.0.1
5.0.2
5.1.0
5.1.1
5.2.0
6.0.0
6.0.1
6.0.2
6.1.0
6.1.1
6.2.0
6.2.1
6.2.2
7.0.0
7.0.0-alpha-0001
7.0.1
8.0.0
8.1.0
8.1.1
9.0.0
Fixed in
15.1.1
16.1.1
References
Updated Sep 10, 2026 · Source: OSV.dev |
3.1.1
patch
|
|
3.1.0
minor
1 CVE
CVE-2026-32933
GHSA-rvv3-g6hj-g44x
Mar 13, 2026
AutoMapper Vulnerable to Denial of Service (DoS) via Uncontrolled Recursion
7.5
/ 10
High
Network
Low
None
None
Unchanged
None
None
High
SummaryAutoMapper is vulnerable to a Denial of Service (DoS) attack. When mapping deeply nested object graphs, the library uses recursive method calls without enforcing a default maximum depth limit. This allows an attacker to provide a specially crafted object graph that exhausts the thread's stack memory, triggering a DescriptionThe vulnerability exists in the core mapping engine. When a source object contains a property of the same type (or a type that eventually points back to itself), AutoMapper recursively attempts to map each level. Because there is no default limit on how many levels deep this recursion can go, a sufficiently nested object (approximately 25,000+ levels in standard .NET environments) will exceed the stack size. Since Impact
Proof of Concept (PoC)The following C# code demonstrates the crash by creating a nested "Circular" object graph and attempting to map it: Recommended Mitigation
Affected versions
16.0.0
16.1.0
1.1.0.118
1.1.1
1.1.2
10.0.0
10.1.0
10.1.1
11.0.0
11.0.1
12.0.0
12.0.1
+ 217 more Show less
13.0.0
13.0.1
14.0.0
15.0.0
15.0.1
15.1.0
2.0.0
2.1.1
2.1.262
2.1.265
2.1.266
2.1.267
2.2.0
2.2.1
2.2.1-ci10
2.2.1-ci1000
2.2.1-ci11
2.2.1-ci15
2.2.1-ci16
2.2.1-ci17
2.2.1-ci4
2.2.1-ci5
2.2.1-ci6
2.2.1-ci7
2.2.1-ci8
2.2.1-ci9
2.2.1-ci9000
2.2.1-ci9001
2.2.1-ci9002
2.2.1-ci9003
2.2.1-ci9004
2.2.1-ci9005
2.2.1-ci9006
2.2.24-ci
2.2.25-ci
3.0.0
3.0.0-ci1026
3.0.0-ci1028
3.0.0-ci1029
3.0.0-ci1031
3.0.0-ci1032
3.0.0-ci1033
3.0.0-ci1034
3.0.0-ci1035
3.0.0-ci1036
3.0.0-ci1037
3.0.0-ci1038
3.0.0-ci1039
3.0.0-ci1040
3.0.0-ci1041
3.0.0-ci1042
3.0.0-ci1043
3.0.0-ci1053
3.1.0
3.1.0-ci1014
3.1.0-ci1016
3.1.0-ci1017
3.1.0-ci1018
3.1.0-ci1019
3.1.0-ci1020
3.1.0-ci1021
3.1.0-ci1022
3.1.0-ci1023
3.1.0-ci1024
3.1.0-ci1026
3.1.0-ci1027
3.1.0-ci1032
3.1.0-ci1033
3.1.0-ci1034
3.1.0-ci1035
3.1.0-ci1036
3.1.0-ci1037
3.1.0-ci1038
3.1.0-ci1043
3.1.0-ci1044
3.1.0-ci1045
3.1.0-ci1046
3.1.0-ci1047
3.1.0-ci1048
3.1.0-ci1049
3.1.0-ci1050
3.1.0-ci1051
3.1.0-ci1053
3.1.0-ci1056
3.1.0-ci1058
3.1.1
3.1.1-ci1000
3.1.1-ci1003
3.2.0
3.2.0-ci1000
3.2.0-ci1001
3.2.0-ci1002
3.2.0-ci1003
3.2.0-ci1004
3.2.0-ci1005
3.2.0-ci1008
3.2.0-ci1009
3.2.0-ci1010
3.2.0-ci1011
3.2.0-ci1014
3.2.0-ci1015
3.2.0-ci1016
3.2.0-ci1017
3.2.0-ci1021
3.2.0-ci1022
3.2.0-ci1023
3.2.0-ci1024
3.2.0-ci1025
3.2.0-ci1026
3.2.0-ci1027
3.2.0-ci1028
3.2.0-ci1029
3.2.0-ci1030
3.2.0-ci1033
3.2.0-ci1034
3.2.0-ci1035
3.2.0-ci1036
3.2.0-ci1037
3.2.0-ci1038
3.2.0-ci1039
3.2.0-ci1040
3.2.0-ci1041
3.2.0-ci1042
3.2.0-ci1043
3.2.1
3.2.1-ci1000
3.2.1-ci1001
3.2.1-ci1002
3.3.0
3.3.0-ci1000
3.3.0-ci1001
3.3.0-ci1002
3.3.0-ci1003
3.3.0-ci1004
3.3.0-ci1005
3.3.0-ci1006
3.3.0-ci1007
3.3.0-ci1008
3.3.0-ci1009
3.3.0-ci1016
3.3.0-ci1017
3.3.0-ci1018
3.3.0-ci1019
3.3.0-ci1020
3.3.0-ci1021
3.3.0-ci1022
3.3.0-ci1023
3.3.0-ci1024
3.3.0-ci1025
3.3.0-ci1026
3.3.0-ci1027
3.3.0-ci1028
3.3.0-ci1029
3.3.0-ci1030
3.3.0-ci1031
3.3.0-ci1032
3.3.0-ci1033
3.3.1
4.0.0
4.0.0-alpha1
4.0.0-ci1002
4.0.0-ci1004
4.0.0-ci1006
4.0.0-ci1007
4.0.0-ci1014
4.0.0-ci1015
4.0.0-ci1017
4.0.0-ci1018
4.0.0-ci1019
4.0.0-ci1020
4.0.0-ci1021
4.0.0-ci1026
4.0.0-ci1031
4.0.0-ci1032
4.0.0-ci1034
4.0.0-ci1036
4.0.0-ci1038
4.0.0-ci1046
4.0.0-ci1049
4.0.0-ci1050
4.0.0-ci1051
4.0.0-ci1052
4.0.0-ci1053
4.0.0-ci1054
4.0.0-ci1056
4.0.0-ci1057
4.0.0-ci1061
4.0.1
4.0.2
4.0.3
4.0.4
4.1.0
4.1.1
4.2.0
4.2.1
5.0.0
5.0.0-beta-1
5.0.1
5.0.2
5.1.0
5.1.1
5.2.0
6.0.0
6.0.1
6.0.2
6.1.0
6.1.1
6.2.0
6.2.1
6.2.2
7.0.0
7.0.0-alpha-0001
7.0.1
8.0.0
8.1.0
8.1.1
9.0.0
Fixed in
15.1.1
16.1.1
References
Updated Sep 10, 2026 · Source: OSV.dev |
3.1.0
minor
|
|
3.0.0
major
1 CVE
CVE-2026-32933
GHSA-rvv3-g6hj-g44x
Mar 13, 2026
AutoMapper Vulnerable to Denial of Service (DoS) via Uncontrolled Recursion
7.5
/ 10
High
Network
Low
None
None
Unchanged
None
None
High
SummaryAutoMapper is vulnerable to a Denial of Service (DoS) attack. When mapping deeply nested object graphs, the library uses recursive method calls without enforcing a default maximum depth limit. This allows an attacker to provide a specially crafted object graph that exhausts the thread's stack memory, triggering a DescriptionThe vulnerability exists in the core mapping engine. When a source object contains a property of the same type (or a type that eventually points back to itself), AutoMapper recursively attempts to map each level. Because there is no default limit on how many levels deep this recursion can go, a sufficiently nested object (approximately 25,000+ levels in standard .NET environments) will exceed the stack size. Since Impact
Proof of Concept (PoC)The following C# code demonstrates the crash by creating a nested "Circular" object graph and attempting to map it: Recommended Mitigation
Affected versions
16.0.0
16.1.0
1.1.0.118
1.1.1
1.1.2
10.0.0
10.1.0
10.1.1
11.0.0
11.0.1
12.0.0
12.0.1
+ 217 more Show less
13.0.0
13.0.1
14.0.0
15.0.0
15.0.1
15.1.0
2.0.0
2.1.1
2.1.262
2.1.265
2.1.266
2.1.267
2.2.0
2.2.1
2.2.1-ci10
2.2.1-ci1000
2.2.1-ci11
2.2.1-ci15
2.2.1-ci16
2.2.1-ci17
2.2.1-ci4
2.2.1-ci5
2.2.1-ci6
2.2.1-ci7
2.2.1-ci8
2.2.1-ci9
2.2.1-ci9000
2.2.1-ci9001
2.2.1-ci9002
2.2.1-ci9003
2.2.1-ci9004
2.2.1-ci9005
2.2.1-ci9006
2.2.24-ci
2.2.25-ci
3.0.0
3.0.0-ci1026
3.0.0-ci1028
3.0.0-ci1029
3.0.0-ci1031
3.0.0-ci1032
3.0.0-ci1033
3.0.0-ci1034
3.0.0-ci1035
3.0.0-ci1036
3.0.0-ci1037
3.0.0-ci1038
3.0.0-ci1039
3.0.0-ci1040
3.0.0-ci1041
3.0.0-ci1042
3.0.0-ci1043
3.0.0-ci1053
3.1.0
3.1.0-ci1014
3.1.0-ci1016
3.1.0-ci1017
3.1.0-ci1018
3.1.0-ci1019
3.1.0-ci1020
3.1.0-ci1021
3.1.0-ci1022
3.1.0-ci1023
3.1.0-ci1024
3.1.0-ci1026
3.1.0-ci1027
3.1.0-ci1032
3.1.0-ci1033
3.1.0-ci1034
3.1.0-ci1035
3.1.0-ci1036
3.1.0-ci1037
3.1.0-ci1038
3.1.0-ci1043
3.1.0-ci1044
3.1.0-ci1045
3.1.0-ci1046
3.1.0-ci1047
3.1.0-ci1048
3.1.0-ci1049
3.1.0-ci1050
3.1.0-ci1051
3.1.0-ci1053
3.1.0-ci1056
3.1.0-ci1058
3.1.1
3.1.1-ci1000
3.1.1-ci1003
3.2.0
3.2.0-ci1000
3.2.0-ci1001
3.2.0-ci1002
3.2.0-ci1003
3.2.0-ci1004
3.2.0-ci1005
3.2.0-ci1008
3.2.0-ci1009
3.2.0-ci1010
3.2.0-ci1011
3.2.0-ci1014
3.2.0-ci1015
3.2.0-ci1016
3.2.0-ci1017
3.2.0-ci1021
3.2.0-ci1022
3.2.0-ci1023
3.2.0-ci1024
3.2.0-ci1025
3.2.0-ci1026
3.2.0-ci1027
3.2.0-ci1028
3.2.0-ci1029
3.2.0-ci1030
3.2.0-ci1033
3.2.0-ci1034
3.2.0-ci1035
3.2.0-ci1036
3.2.0-ci1037
3.2.0-ci1038
3.2.0-ci1039
3.2.0-ci1040
3.2.0-ci1041
3.2.0-ci1042
3.2.0-ci1043
3.2.1
3.2.1-ci1000
3.2.1-ci1001
3.2.1-ci1002
3.3.0
3.3.0-ci1000
3.3.0-ci1001
3.3.0-ci1002
3.3.0-ci1003
3.3.0-ci1004
3.3.0-ci1005
3.3.0-ci1006
3.3.0-ci1007
3.3.0-ci1008
3.3.0-ci1009
3.3.0-ci1016
3.3.0-ci1017
3.3.0-ci1018
3.3.0-ci1019
3.3.0-ci1020
3.3.0-ci1021
3.3.0-ci1022
3.3.0-ci1023
3.3.0-ci1024
3.3.0-ci1025
3.3.0-ci1026
3.3.0-ci1027
3.3.0-ci1028
3.3.0-ci1029
3.3.0-ci1030
3.3.0-ci1031
3.3.0-ci1032
3.3.0-ci1033
3.3.1
4.0.0
4.0.0-alpha1
4.0.0-ci1002
4.0.0-ci1004
4.0.0-ci1006
4.0.0-ci1007
4.0.0-ci1014
4.0.0-ci1015
4.0.0-ci1017
4.0.0-ci1018
4.0.0-ci1019
4.0.0-ci1020
4.0.0-ci1021
4.0.0-ci1026
4.0.0-ci1031
4.0.0-ci1032
4.0.0-ci1034
4.0.0-ci1036
4.0.0-ci1038
4.0.0-ci1046
4.0.0-ci1049
4.0.0-ci1050
4.0.0-ci1051
4.0.0-ci1052
4.0.0-ci1053
4.0.0-ci1054
4.0.0-ci1056
4.0.0-ci1057
4.0.0-ci1061
4.0.1
4.0.2
4.0.3
4.0.4
4.1.0
4.1.1
4.2.0
4.2.1
5.0.0
5.0.0-beta-1
5.0.1
5.0.2
5.1.0
5.1.1
5.2.0
6.0.0
6.0.1
6.0.2
6.1.0
6.1.1
6.2.0
6.2.1
6.2.2
7.0.0
7.0.0-alpha-0001
7.0.1
8.0.0
8.1.0
8.1.1
9.0.0
Fixed in
15.1.1
16.1.1
References
Updated Sep 10, 2026 · Source: OSV.dev |
3.0.0
major
|
|
2.2.1
patch
1 CVE
CVE-2026-32933
GHSA-rvv3-g6hj-g44x
Mar 13, 2026
AutoMapper Vulnerable to Denial of Service (DoS) via Uncontrolled Recursion
7.5
/ 10
High
Network
Low
None
None
Unchanged
None
None
High
SummaryAutoMapper is vulnerable to a Denial of Service (DoS) attack. When mapping deeply nested object graphs, the library uses recursive method calls without enforcing a default maximum depth limit. This allows an attacker to provide a specially crafted object graph that exhausts the thread's stack memory, triggering a DescriptionThe vulnerability exists in the core mapping engine. When a source object contains a property of the same type (or a type that eventually points back to itself), AutoMapper recursively attempts to map each level. Because there is no default limit on how many levels deep this recursion can go, a sufficiently nested object (approximately 25,000+ levels in standard .NET environments) will exceed the stack size. Since Impact
Proof of Concept (PoC)The following C# code demonstrates the crash by creating a nested "Circular" object graph and attempting to map it: Recommended Mitigation
Affected versions
16.0.0
16.1.0
1.1.0.118
1.1.1
1.1.2
10.0.0
10.1.0
10.1.1
11.0.0
11.0.1
12.0.0
12.0.1
+ 217 more Show less
13.0.0
13.0.1
14.0.0
15.0.0
15.0.1
15.1.0
2.0.0
2.1.1
2.1.262
2.1.265
2.1.266
2.1.267
2.2.0
2.2.1
2.2.1-ci10
2.2.1-ci1000
2.2.1-ci11
2.2.1-ci15
2.2.1-ci16
2.2.1-ci17
2.2.1-ci4
2.2.1-ci5
2.2.1-ci6
2.2.1-ci7
2.2.1-ci8
2.2.1-ci9
2.2.1-ci9000
2.2.1-ci9001
2.2.1-ci9002
2.2.1-ci9003
2.2.1-ci9004
2.2.1-ci9005
2.2.1-ci9006
2.2.24-ci
2.2.25-ci
3.0.0
3.0.0-ci1026
3.0.0-ci1028
3.0.0-ci1029
3.0.0-ci1031
3.0.0-ci1032
3.0.0-ci1033
3.0.0-ci1034
3.0.0-ci1035
3.0.0-ci1036
3.0.0-ci1037
3.0.0-ci1038
3.0.0-ci1039
3.0.0-ci1040
3.0.0-ci1041
3.0.0-ci1042
3.0.0-ci1043
3.0.0-ci1053
3.1.0
3.1.0-ci1014
3.1.0-ci1016
3.1.0-ci1017
3.1.0-ci1018
3.1.0-ci1019
3.1.0-ci1020
3.1.0-ci1021
3.1.0-ci1022
3.1.0-ci1023
3.1.0-ci1024
3.1.0-ci1026
3.1.0-ci1027
3.1.0-ci1032
3.1.0-ci1033
3.1.0-ci1034
3.1.0-ci1035
3.1.0-ci1036
3.1.0-ci1037
3.1.0-ci1038
3.1.0-ci1043
3.1.0-ci1044
3.1.0-ci1045
3.1.0-ci1046
3.1.0-ci1047
3.1.0-ci1048
3.1.0-ci1049
3.1.0-ci1050
3.1.0-ci1051
3.1.0-ci1053
3.1.0-ci1056
3.1.0-ci1058
3.1.1
3.1.1-ci1000
3.1.1-ci1003
3.2.0
3.2.0-ci1000
3.2.0-ci1001
3.2.0-ci1002
3.2.0-ci1003
3.2.0-ci1004
3.2.0-ci1005
3.2.0-ci1008
3.2.0-ci1009
3.2.0-ci1010
3.2.0-ci1011
3.2.0-ci1014
3.2.0-ci1015
3.2.0-ci1016
3.2.0-ci1017
3.2.0-ci1021
3.2.0-ci1022
3.2.0-ci1023
3.2.0-ci1024
3.2.0-ci1025
3.2.0-ci1026
3.2.0-ci1027
3.2.0-ci1028
3.2.0-ci1029
3.2.0-ci1030
3.2.0-ci1033
3.2.0-ci1034
3.2.0-ci1035
3.2.0-ci1036
3.2.0-ci1037
3.2.0-ci1038
3.2.0-ci1039
3.2.0-ci1040
3.2.0-ci1041
3.2.0-ci1042
3.2.0-ci1043
3.2.1
3.2.1-ci1000
3.2.1-ci1001
3.2.1-ci1002
3.3.0
3.3.0-ci1000
3.3.0-ci1001
3.3.0-ci1002
3.3.0-ci1003
3.3.0-ci1004
3.3.0-ci1005
3.3.0-ci1006
3.3.0-ci1007
3.3.0-ci1008
3.3.0-ci1009
3.3.0-ci1016
3.3.0-ci1017
3.3.0-ci1018
3.3.0-ci1019
3.3.0-ci1020
3.3.0-ci1021
3.3.0-ci1022
3.3.0-ci1023
3.3.0-ci1024
3.3.0-ci1025
3.3.0-ci1026
3.3.0-ci1027
3.3.0-ci1028
3.3.0-ci1029
3.3.0-ci1030
3.3.0-ci1031
3.3.0-ci1032
3.3.0-ci1033
3.3.1
4.0.0
4.0.0-alpha1
4.0.0-ci1002
4.0.0-ci1004
4.0.0-ci1006
4.0.0-ci1007
4.0.0-ci1014
4.0.0-ci1015
4.0.0-ci1017
4.0.0-ci1018
4.0.0-ci1019
4.0.0-ci1020
4.0.0-ci1021
4.0.0-ci1026
4.0.0-ci1031
4.0.0-ci1032
4.0.0-ci1034
4.0.0-ci1036
4.0.0-ci1038
4.0.0-ci1046
4.0.0-ci1049
4.0.0-ci1050
4.0.0-ci1051
4.0.0-ci1052
4.0.0-ci1053
4.0.0-ci1054
4.0.0-ci1056
4.0.0-ci1057
4.0.0-ci1061
4.0.1
4.0.2
4.0.3
4.0.4
4.1.0
4.1.1
4.2.0
4.2.1
5.0.0
5.0.0-beta-1
5.0.1
5.0.2
5.1.0
5.1.1
5.2.0
6.0.0
6.0.1
6.0.2
6.1.0
6.1.1
6.2.0
6.2.1
6.2.2
7.0.0
7.0.0-alpha-0001
7.0.1
8.0.0
8.1.0
8.1.1
9.0.0
Fixed in
15.1.1
16.1.1
References
Updated Sep 10, 2026 · Source: OSV.dev |
2.2.1
patch
|
|
2.2.0
minor
1 CVE
CVE-2026-32933
GHSA-rvv3-g6hj-g44x
Mar 13, 2026
AutoMapper Vulnerable to Denial of Service (DoS) via Uncontrolled Recursion
7.5
/ 10
High
Network
Low
None
None
Unchanged
None
None
High
SummaryAutoMapper is vulnerable to a Denial of Service (DoS) attack. When mapping deeply nested object graphs, the library uses recursive method calls without enforcing a default maximum depth limit. This allows an attacker to provide a specially crafted object graph that exhausts the thread's stack memory, triggering a DescriptionThe vulnerability exists in the core mapping engine. When a source object contains a property of the same type (or a type that eventually points back to itself), AutoMapper recursively attempts to map each level. Because there is no default limit on how many levels deep this recursion can go, a sufficiently nested object (approximately 25,000+ levels in standard .NET environments) will exceed the stack size. Since Impact
Proof of Concept (PoC)The following C# code demonstrates the crash by creating a nested "Circular" object graph and attempting to map it: Recommended Mitigation
Affected versions
16.0.0
16.1.0
1.1.0.118
1.1.1
1.1.2
10.0.0
10.1.0
10.1.1
11.0.0
11.0.1
12.0.0
12.0.1
+ 217 more Show less
13.0.0
13.0.1
14.0.0
15.0.0
15.0.1
15.1.0
2.0.0
2.1.1
2.1.262
2.1.265
2.1.266
2.1.267
2.2.0
2.2.1
2.2.1-ci10
2.2.1-ci1000
2.2.1-ci11
2.2.1-ci15
2.2.1-ci16
2.2.1-ci17
2.2.1-ci4
2.2.1-ci5
2.2.1-ci6
2.2.1-ci7
2.2.1-ci8
2.2.1-ci9
2.2.1-ci9000
2.2.1-ci9001
2.2.1-ci9002
2.2.1-ci9003
2.2.1-ci9004
2.2.1-ci9005
2.2.1-ci9006
2.2.24-ci
2.2.25-ci
3.0.0
3.0.0-ci1026
3.0.0-ci1028
3.0.0-ci1029
3.0.0-ci1031
3.0.0-ci1032
3.0.0-ci1033
3.0.0-ci1034
3.0.0-ci1035
3.0.0-ci1036
3.0.0-ci1037
3.0.0-ci1038
3.0.0-ci1039
3.0.0-ci1040
3.0.0-ci1041
3.0.0-ci1042
3.0.0-ci1043
3.0.0-ci1053
3.1.0
3.1.0-ci1014
3.1.0-ci1016
3.1.0-ci1017
3.1.0-ci1018
3.1.0-ci1019
3.1.0-ci1020
3.1.0-ci1021
3.1.0-ci1022
3.1.0-ci1023
3.1.0-ci1024
3.1.0-ci1026
3.1.0-ci1027
3.1.0-ci1032
3.1.0-ci1033
3.1.0-ci1034
3.1.0-ci1035
3.1.0-ci1036
3.1.0-ci1037
3.1.0-ci1038
3.1.0-ci1043
3.1.0-ci1044
3.1.0-ci1045
3.1.0-ci1046
3.1.0-ci1047
3.1.0-ci1048
3.1.0-ci1049
3.1.0-ci1050
3.1.0-ci1051
3.1.0-ci1053
3.1.0-ci1056
3.1.0-ci1058
3.1.1
3.1.1-ci1000
3.1.1-ci1003
3.2.0
3.2.0-ci1000
3.2.0-ci1001
3.2.0-ci1002
3.2.0-ci1003
3.2.0-ci1004
3.2.0-ci1005
3.2.0-ci1008
3.2.0-ci1009
3.2.0-ci1010
3.2.0-ci1011
3.2.0-ci1014
3.2.0-ci1015
3.2.0-ci1016
3.2.0-ci1017
3.2.0-ci1021
3.2.0-ci1022
3.2.0-ci1023
3.2.0-ci1024
3.2.0-ci1025
3.2.0-ci1026
3.2.0-ci1027
3.2.0-ci1028
3.2.0-ci1029
3.2.0-ci1030
3.2.0-ci1033
3.2.0-ci1034
3.2.0-ci1035
3.2.0-ci1036
3.2.0-ci1037
3.2.0-ci1038
3.2.0-ci1039
3.2.0-ci1040
3.2.0-ci1041
3.2.0-ci1042
3.2.0-ci1043
3.2.1
3.2.1-ci1000
3.2.1-ci1001
3.2.1-ci1002
3.3.0
3.3.0-ci1000
3.3.0-ci1001
3.3.0-ci1002
3.3.0-ci1003
3.3.0-ci1004
3.3.0-ci1005
3.3.0-ci1006
3.3.0-ci1007
3.3.0-ci1008
3.3.0-ci1009
3.3.0-ci1016
3.3.0-ci1017
3.3.0-ci1018
3.3.0-ci1019
3.3.0-ci1020
3.3.0-ci1021
3.3.0-ci1022
3.3.0-ci1023
3.3.0-ci1024
3.3.0-ci1025
3.3.0-ci1026
3.3.0-ci1027
3.3.0-ci1028
3.3.0-ci1029
3.3.0-ci1030
3.3.0-ci1031
3.3.0-ci1032
3.3.0-ci1033
3.3.1
4.0.0
4.0.0-alpha1
4.0.0-ci1002
4.0.0-ci1004
4.0.0-ci1006
4.0.0-ci1007
4.0.0-ci1014
4.0.0-ci1015
4.0.0-ci1017
4.0.0-ci1018
4.0.0-ci1019
4.0.0-ci1020
4.0.0-ci1021
4.0.0-ci1026
4.0.0-ci1031
4.0.0-ci1032
4.0.0-ci1034
4.0.0-ci1036
4.0.0-ci1038
4.0.0-ci1046
4.0.0-ci1049
4.0.0-ci1050
4.0.0-ci1051
4.0.0-ci1052
4.0.0-ci1053
4.0.0-ci1054
4.0.0-ci1056
4.0.0-ci1057
4.0.0-ci1061
4.0.1
4.0.2
4.0.3
4.0.4
4.1.0
4.1.1
4.2.0
4.2.1
5.0.0
5.0.0-beta-1
5.0.1
5.0.2
5.1.0
5.1.1
5.2.0
6.0.0
6.0.1
6.0.2
6.1.0
6.1.1
6.2.0
6.2.1
6.2.2
7.0.0
7.0.0-alpha-0001
7.0.1
8.0.0
8.1.0
8.1.1
9.0.0
Fixed in
15.1.1
16.1.1
References
Updated Sep 10, 2026 · Source: OSV.dev |
2.2.0
minor
|
|
2.1.1
minor
1 CVE
CVE-2026-32933
GHSA-rvv3-g6hj-g44x
Mar 13, 2026
AutoMapper Vulnerable to Denial of Service (DoS) via Uncontrolled Recursion
7.5
/ 10
High
Network
Low
None
None
Unchanged
None
None
High
SummaryAutoMapper is vulnerable to a Denial of Service (DoS) attack. When mapping deeply nested object graphs, the library uses recursive method calls without enforcing a default maximum depth limit. This allows an attacker to provide a specially crafted object graph that exhausts the thread's stack memory, triggering a DescriptionThe vulnerability exists in the core mapping engine. When a source object contains a property of the same type (or a type that eventually points back to itself), AutoMapper recursively attempts to map each level. Because there is no default limit on how many levels deep this recursion can go, a sufficiently nested object (approximately 25,000+ levels in standard .NET environments) will exceed the stack size. Since Impact
Proof of Concept (PoC)The following C# code demonstrates the crash by creating a nested "Circular" object graph and attempting to map it: Recommended Mitigation
Affected versions
16.0.0
16.1.0
1.1.0.118
1.1.1
1.1.2
10.0.0
10.1.0
10.1.1
11.0.0
11.0.1
12.0.0
12.0.1
+ 217 more Show less
13.0.0
13.0.1
14.0.0
15.0.0
15.0.1
15.1.0
2.0.0
2.1.1
2.1.262
2.1.265
2.1.266
2.1.267
2.2.0
2.2.1
2.2.1-ci10
2.2.1-ci1000
2.2.1-ci11
2.2.1-ci15
2.2.1-ci16
2.2.1-ci17
2.2.1-ci4
2.2.1-ci5
2.2.1-ci6
2.2.1-ci7
2.2.1-ci8
2.2.1-ci9
2.2.1-ci9000
2.2.1-ci9001
2.2.1-ci9002
2.2.1-ci9003
2.2.1-ci9004
2.2.1-ci9005
2.2.1-ci9006
2.2.24-ci
2.2.25-ci
3.0.0
3.0.0-ci1026
3.0.0-ci1028
3.0.0-ci1029
3.0.0-ci1031
3.0.0-ci1032
3.0.0-ci1033
3.0.0-ci1034
3.0.0-ci1035
3.0.0-ci1036
3.0.0-ci1037
3.0.0-ci1038
3.0.0-ci1039
3.0.0-ci1040
3.0.0-ci1041
3.0.0-ci1042
3.0.0-ci1043
3.0.0-ci1053
3.1.0
3.1.0-ci1014
3.1.0-ci1016
3.1.0-ci1017
3.1.0-ci1018
3.1.0-ci1019
3.1.0-ci1020
3.1.0-ci1021
3.1.0-ci1022
3.1.0-ci1023
3.1.0-ci1024
3.1.0-ci1026
3.1.0-ci1027
3.1.0-ci1032
3.1.0-ci1033
3.1.0-ci1034
3.1.0-ci1035
3.1.0-ci1036
3.1.0-ci1037
3.1.0-ci1038
3.1.0-ci1043
3.1.0-ci1044
3.1.0-ci1045
3.1.0-ci1046
3.1.0-ci1047
3.1.0-ci1048
3.1.0-ci1049
3.1.0-ci1050
3.1.0-ci1051
3.1.0-ci1053
3.1.0-ci1056
3.1.0-ci1058
3.1.1
3.1.1-ci1000
3.1.1-ci1003
3.2.0
3.2.0-ci1000
3.2.0-ci1001
3.2.0-ci1002
3.2.0-ci1003
3.2.0-ci1004
3.2.0-ci1005
3.2.0-ci1008
3.2.0-ci1009
3.2.0-ci1010
3.2.0-ci1011
3.2.0-ci1014
3.2.0-ci1015
3.2.0-ci1016
3.2.0-ci1017
3.2.0-ci1021
3.2.0-ci1022
3.2.0-ci1023
3.2.0-ci1024
3.2.0-ci1025
3.2.0-ci1026
3.2.0-ci1027
3.2.0-ci1028
3.2.0-ci1029
3.2.0-ci1030
3.2.0-ci1033
3.2.0-ci1034
3.2.0-ci1035
3.2.0-ci1036
3.2.0-ci1037
3.2.0-ci1038
3.2.0-ci1039
3.2.0-ci1040
3.2.0-ci1041
3.2.0-ci1042
3.2.0-ci1043
3.2.1
3.2.1-ci1000
3.2.1-ci1001
3.2.1-ci1002
3.3.0
3.3.0-ci1000
3.3.0-ci1001
3.3.0-ci1002
3.3.0-ci1003
3.3.0-ci1004
3.3.0-ci1005
3.3.0-ci1006
3.3.0-ci1007
3.3.0-ci1008
3.3.0-ci1009
3.3.0-ci1016
3.3.0-ci1017
3.3.0-ci1018
3.3.0-ci1019
3.3.0-ci1020
3.3.0-ci1021
3.3.0-ci1022
3.3.0-ci1023
3.3.0-ci1024
3.3.0-ci1025
3.3.0-ci1026
3.3.0-ci1027
3.3.0-ci1028
3.3.0-ci1029
3.3.0-ci1030
3.3.0-ci1031
3.3.0-ci1032
3.3.0-ci1033
3.3.1
4.0.0
4.0.0-alpha1
4.0.0-ci1002
4.0.0-ci1004
4.0.0-ci1006
4.0.0-ci1007
4.0.0-ci1014
4.0.0-ci1015
4.0.0-ci1017
4.0.0-ci1018
4.0.0-ci1019
4.0.0-ci1020
4.0.0-ci1021
4.0.0-ci1026
4.0.0-ci1031
4.0.0-ci1032
4.0.0-ci1034
4.0.0-ci1036
4.0.0-ci1038
4.0.0-ci1046
4.0.0-ci1049
4.0.0-ci1050
4.0.0-ci1051
4.0.0-ci1052
4.0.0-ci1053
4.0.0-ci1054
4.0.0-ci1056
4.0.0-ci1057
4.0.0-ci1061
4.0.1
4.0.2
4.0.3
4.0.4
4.1.0
4.1.1
4.2.0
4.2.1
5.0.0
5.0.0-beta-1
5.0.1
5.0.2
5.1.0
5.1.1
5.2.0
6.0.0
6.0.1
6.0.2
6.1.0
6.1.1
6.2.0
6.2.1
6.2.2
7.0.0
7.0.0-alpha-0001
7.0.1
8.0.0
8.1.0
8.1.1
9.0.0
Fixed in
15.1.1
16.1.1
References
Updated Sep 10, 2026 · Source: OSV.dev |
2.1.1
minor
|
|
2.1.267
patch
1 CVE
CVE-2026-32933
GHSA-rvv3-g6hj-g44x
Mar 13, 2026
AutoMapper Vulnerable to Denial of Service (DoS) via Uncontrolled Recursion
7.5
/ 10
High
Network
Low
None
None
Unchanged
None
None
High
SummaryAutoMapper is vulnerable to a Denial of Service (DoS) attack. When mapping deeply nested object graphs, the library uses recursive method calls without enforcing a default maximum depth limit. This allows an attacker to provide a specially crafted object graph that exhausts the thread's stack memory, triggering a DescriptionThe vulnerability exists in the core mapping engine. When a source object contains a property of the same type (or a type that eventually points back to itself), AutoMapper recursively attempts to map each level. Because there is no default limit on how many levels deep this recursion can go, a sufficiently nested object (approximately 25,000+ levels in standard .NET environments) will exceed the stack size. Since Impact
Proof of Concept (PoC)The following C# code demonstrates the crash by creating a nested "Circular" object graph and attempting to map it: Recommended Mitigation
Affected versions
16.0.0
16.1.0
1.1.0.118
1.1.1
1.1.2
10.0.0
10.1.0
10.1.1
11.0.0
11.0.1
12.0.0
12.0.1
+ 217 more Show less
13.0.0
13.0.1
14.0.0
15.0.0
15.0.1
15.1.0
2.0.0
2.1.1
2.1.262
2.1.265
2.1.266
2.1.267
2.2.0
2.2.1
2.2.1-ci10
2.2.1-ci1000
2.2.1-ci11
2.2.1-ci15
2.2.1-ci16
2.2.1-ci17
2.2.1-ci4
2.2.1-ci5
2.2.1-ci6
2.2.1-ci7
2.2.1-ci8
2.2.1-ci9
2.2.1-ci9000
2.2.1-ci9001
2.2.1-ci9002
2.2.1-ci9003
2.2.1-ci9004
2.2.1-ci9005
2.2.1-ci9006
2.2.24-ci
2.2.25-ci
3.0.0
3.0.0-ci1026
3.0.0-ci1028
3.0.0-ci1029
3.0.0-ci1031
3.0.0-ci1032
3.0.0-ci1033
3.0.0-ci1034
3.0.0-ci1035
3.0.0-ci1036
3.0.0-ci1037
3.0.0-ci1038
3.0.0-ci1039
3.0.0-ci1040
3.0.0-ci1041
3.0.0-ci1042
3.0.0-ci1043
3.0.0-ci1053
3.1.0
3.1.0-ci1014
3.1.0-ci1016
3.1.0-ci1017
3.1.0-ci1018
3.1.0-ci1019
3.1.0-ci1020
3.1.0-ci1021
3.1.0-ci1022
3.1.0-ci1023
3.1.0-ci1024
3.1.0-ci1026
3.1.0-ci1027
3.1.0-ci1032
3.1.0-ci1033
3.1.0-ci1034
3.1.0-ci1035
3.1.0-ci1036
3.1.0-ci1037
3.1.0-ci1038
3.1.0-ci1043
3.1.0-ci1044
3.1.0-ci1045
3.1.0-ci1046
3.1.0-ci1047
3.1.0-ci1048
3.1.0-ci1049
3.1.0-ci1050
3.1.0-ci1051
3.1.0-ci1053
3.1.0-ci1056
3.1.0-ci1058
3.1.1
3.1.1-ci1000
3.1.1-ci1003
3.2.0
3.2.0-ci1000
3.2.0-ci1001
3.2.0-ci1002
3.2.0-ci1003
3.2.0-ci1004
3.2.0-ci1005
3.2.0-ci1008
3.2.0-ci1009
3.2.0-ci1010
3.2.0-ci1011
3.2.0-ci1014
3.2.0-ci1015
3.2.0-ci1016
3.2.0-ci1017
3.2.0-ci1021
3.2.0-ci1022
3.2.0-ci1023
3.2.0-ci1024
3.2.0-ci1025
3.2.0-ci1026
3.2.0-ci1027
3.2.0-ci1028
3.2.0-ci1029
3.2.0-ci1030
3.2.0-ci1033
3.2.0-ci1034
3.2.0-ci1035
3.2.0-ci1036
3.2.0-ci1037
3.2.0-ci1038
3.2.0-ci1039
3.2.0-ci1040
3.2.0-ci1041
3.2.0-ci1042
3.2.0-ci1043
3.2.1
3.2.1-ci1000
3.2.1-ci1001
3.2.1-ci1002
3.3.0
3.3.0-ci1000
3.3.0-ci1001
3.3.0-ci1002
3.3.0-ci1003
3.3.0-ci1004
3.3.0-ci1005
3.3.0-ci1006
3.3.0-ci1007
3.3.0-ci1008
3.3.0-ci1009
3.3.0-ci1016
3.3.0-ci1017
3.3.0-ci1018
3.3.0-ci1019
3.3.0-ci1020
3.3.0-ci1021
3.3.0-ci1022
3.3.0-ci1023
3.3.0-ci1024
3.3.0-ci1025
3.3.0-ci1026
3.3.0-ci1027
3.3.0-ci1028
3.3.0-ci1029
3.3.0-ci1030
3.3.0-ci1031
3.3.0-ci1032
3.3.0-ci1033
3.3.1
4.0.0
4.0.0-alpha1
4.0.0-ci1002
4.0.0-ci1004
4.0.0-ci1006
4.0.0-ci1007
4.0.0-ci1014
4.0.0-ci1015
4.0.0-ci1017
4.0.0-ci1018
4.0.0-ci1019
4.0.0-ci1020
4.0.0-ci1021
4.0.0-ci1026
4.0.0-ci1031
4.0.0-ci1032
4.0.0-ci1034
4.0.0-ci1036
4.0.0-ci1038
4.0.0-ci1046
4.0.0-ci1049
4.0.0-ci1050
4.0.0-ci1051
4.0.0-ci1052
4.0.0-ci1053
4.0.0-ci1054
4.0.0-ci1056
4.0.0-ci1057
4.0.0-ci1061
4.0.1
4.0.2
4.0.3
4.0.4
4.1.0
4.1.1
4.2.0
4.2.1
5.0.0
5.0.0-beta-1
5.0.1
5.0.2
5.1.0
5.1.1
5.2.0
6.0.0
6.0.1
6.0.2
6.1.0
6.1.1
6.2.0
6.2.1
6.2.2
7.0.0
7.0.0-alpha-0001
7.0.1
8.0.0
8.1.0
8.1.1
9.0.0
Fixed in
15.1.1
16.1.1
References
Updated Sep 10, 2026 · Source: OSV.dev |
2.1.267
patch
|
|
2.1.266
patch
1 CVE
CVE-2026-32933
GHSA-rvv3-g6hj-g44x
Mar 13, 2026
AutoMapper Vulnerable to Denial of Service (DoS) via Uncontrolled Recursion
7.5
/ 10
High
Network
Low
None
None
Unchanged
None
None
High
SummaryAutoMapper is vulnerable to a Denial of Service (DoS) attack. When mapping deeply nested object graphs, the library uses recursive method calls without enforcing a default maximum depth limit. This allows an attacker to provide a specially crafted object graph that exhausts the thread's stack memory, triggering a DescriptionThe vulnerability exists in the core mapping engine. When a source object contains a property of the same type (or a type that eventually points back to itself), AutoMapper recursively attempts to map each level. Because there is no default limit on how many levels deep this recursion can go, a sufficiently nested object (approximately 25,000+ levels in standard .NET environments) will exceed the stack size. Since Impact
Proof of Concept (PoC)The following C# code demonstrates the crash by creating a nested "Circular" object graph and attempting to map it: Recommended Mitigation
Affected versions
16.0.0
16.1.0
1.1.0.118
1.1.1
1.1.2
10.0.0
10.1.0
10.1.1
11.0.0
11.0.1
12.0.0
12.0.1
+ 217 more Show less
13.0.0
13.0.1
14.0.0
15.0.0
15.0.1
15.1.0
2.0.0
2.1.1
2.1.262
2.1.265
2.1.266
2.1.267
2.2.0
2.2.1
2.2.1-ci10
2.2.1-ci1000
2.2.1-ci11
2.2.1-ci15
2.2.1-ci16
2.2.1-ci17
2.2.1-ci4
2.2.1-ci5
2.2.1-ci6
2.2.1-ci7
2.2.1-ci8
2.2.1-ci9
2.2.1-ci9000
2.2.1-ci9001
2.2.1-ci9002
2.2.1-ci9003
2.2.1-ci9004
2.2.1-ci9005
2.2.1-ci9006
2.2.24-ci
2.2.25-ci
3.0.0
3.0.0-ci1026
3.0.0-ci1028
3.0.0-ci1029
3.0.0-ci1031
3.0.0-ci1032
3.0.0-ci1033
3.0.0-ci1034
3.0.0-ci1035
3.0.0-ci1036
3.0.0-ci1037
3.0.0-ci1038
3.0.0-ci1039
3.0.0-ci1040
3.0.0-ci1041
3.0.0-ci1042
3.0.0-ci1043
3.0.0-ci1053
3.1.0
3.1.0-ci1014
3.1.0-ci1016
3.1.0-ci1017
3.1.0-ci1018
3.1.0-ci1019
3.1.0-ci1020
3.1.0-ci1021
3.1.0-ci1022
3.1.0-ci1023
3.1.0-ci1024
3.1.0-ci1026
3.1.0-ci1027
3.1.0-ci1032
3.1.0-ci1033
3.1.0-ci1034
3.1.0-ci1035
3.1.0-ci1036
3.1.0-ci1037
3.1.0-ci1038
3.1.0-ci1043
3.1.0-ci1044
3.1.0-ci1045
3.1.0-ci1046
3.1.0-ci1047
3.1.0-ci1048
3.1.0-ci1049
3.1.0-ci1050
3.1.0-ci1051
3.1.0-ci1053
3.1.0-ci1056
3.1.0-ci1058
3.1.1
3.1.1-ci1000
3.1.1-ci1003
3.2.0
3.2.0-ci1000
3.2.0-ci1001
3.2.0-ci1002
3.2.0-ci1003
3.2.0-ci1004
3.2.0-ci1005
3.2.0-ci1008
3.2.0-ci1009
3.2.0-ci1010
3.2.0-ci1011
3.2.0-ci1014
3.2.0-ci1015
3.2.0-ci1016
3.2.0-ci1017
3.2.0-ci1021
3.2.0-ci1022
3.2.0-ci1023
3.2.0-ci1024
3.2.0-ci1025
3.2.0-ci1026
3.2.0-ci1027
3.2.0-ci1028
3.2.0-ci1029
3.2.0-ci1030
3.2.0-ci1033
3.2.0-ci1034
3.2.0-ci1035
3.2.0-ci1036
3.2.0-ci1037
3.2.0-ci1038
3.2.0-ci1039
3.2.0-ci1040
3.2.0-ci1041
3.2.0-ci1042
3.2.0-ci1043
3.2.1
3.2.1-ci1000
3.2.1-ci1001
3.2.1-ci1002
3.3.0
3.3.0-ci1000
3.3.0-ci1001
3.3.0-ci1002
3.3.0-ci1003
3.3.0-ci1004
3.3.0-ci1005
3.3.0-ci1006
3.3.0-ci1007
3.3.0-ci1008
3.3.0-ci1009
3.3.0-ci1016
3.3.0-ci1017
3.3.0-ci1018
3.3.0-ci1019
3.3.0-ci1020
3.3.0-ci1021
3.3.0-ci1022
3.3.0-ci1023
3.3.0-ci1024
3.3.0-ci1025
3.3.0-ci1026
3.3.0-ci1027
3.3.0-ci1028
3.3.0-ci1029
3.3.0-ci1030
3.3.0-ci1031
3.3.0-ci1032
3.3.0-ci1033
3.3.1
4.0.0
4.0.0-alpha1
4.0.0-ci1002
4.0.0-ci1004
4.0.0-ci1006
4.0.0-ci1007
4.0.0-ci1014
4.0.0-ci1015
4.0.0-ci1017
4.0.0-ci1018
4.0.0-ci1019
4.0.0-ci1020
4.0.0-ci1021
4.0.0-ci1026
4.0.0-ci1031
4.0.0-ci1032
4.0.0-ci1034
4.0.0-ci1036
4.0.0-ci1038
4.0.0-ci1046
4.0.0-ci1049
4.0.0-ci1050
4.0.0-ci1051
4.0.0-ci1052
4.0.0-ci1053
4.0.0-ci1054
4.0.0-ci1056
4.0.0-ci1057
4.0.0-ci1061
4.0.1
4.0.2
4.0.3
4.0.4
4.1.0
4.1.1
4.2.0
4.2.1
5.0.0
5.0.0-beta-1
5.0.1
5.0.2
5.1.0
5.1.1
5.2.0
6.0.0
6.0.1
6.0.2
6.1.0
6.1.1
6.2.0
6.2.1
6.2.2
7.0.0
7.0.0-alpha-0001
7.0.1
8.0.0
8.1.0
8.1.1
9.0.0
Fixed in
15.1.1
16.1.1
References
Updated Sep 10, 2026 · Source: OSV.dev |
2.1.266
patch
|
|
2.1.265
patch
1 CVE
CVE-2026-32933
GHSA-rvv3-g6hj-g44x
Mar 13, 2026
AutoMapper Vulnerable to Denial of Service (DoS) via Uncontrolled Recursion
7.5
/ 10
High
Network
Low
None
None
Unchanged
None
None
High
SummaryAutoMapper is vulnerable to a Denial of Service (DoS) attack. When mapping deeply nested object graphs, the library uses recursive method calls without enforcing a default maximum depth limit. This allows an attacker to provide a specially crafted object graph that exhausts the thread's stack memory, triggering a DescriptionThe vulnerability exists in the core mapping engine. When a source object contains a property of the same type (or a type that eventually points back to itself), AutoMapper recursively attempts to map each level. Because there is no default limit on how many levels deep this recursion can go, a sufficiently nested object (approximately 25,000+ levels in standard .NET environments) will exceed the stack size. Since Impact
Proof of Concept (PoC)The following C# code demonstrates the crash by creating a nested "Circular" object graph and attempting to map it: Recommended Mitigation
Affected versions
16.0.0
16.1.0
1.1.0.118
1.1.1
1.1.2
10.0.0
10.1.0
10.1.1
11.0.0
11.0.1
12.0.0
12.0.1
+ 217 more Show less
13.0.0
13.0.1
14.0.0
15.0.0
15.0.1
15.1.0
2.0.0
2.1.1
2.1.262
2.1.265
2.1.266
2.1.267
2.2.0
2.2.1
2.2.1-ci10
2.2.1-ci1000
2.2.1-ci11
2.2.1-ci15
2.2.1-ci16
2.2.1-ci17
2.2.1-ci4
2.2.1-ci5
2.2.1-ci6
2.2.1-ci7
2.2.1-ci8
2.2.1-ci9
2.2.1-ci9000
2.2.1-ci9001
2.2.1-ci9002
2.2.1-ci9003
2.2.1-ci9004
2.2.1-ci9005
2.2.1-ci9006
2.2.24-ci
2.2.25-ci
3.0.0
3.0.0-ci1026
3.0.0-ci1028
3.0.0-ci1029
3.0.0-ci1031
3.0.0-ci1032
3.0.0-ci1033
3.0.0-ci1034
3.0.0-ci1035
3.0.0-ci1036
3.0.0-ci1037
3.0.0-ci1038
3.0.0-ci1039
3.0.0-ci1040
3.0.0-ci1041
3.0.0-ci1042
3.0.0-ci1043
3.0.0-ci1053
3.1.0
3.1.0-ci1014
3.1.0-ci1016
3.1.0-ci1017
3.1.0-ci1018
3.1.0-ci1019
3.1.0-ci1020
3.1.0-ci1021
3.1.0-ci1022
3.1.0-ci1023
3.1.0-ci1024
3.1.0-ci1026
3.1.0-ci1027
3.1.0-ci1032
3.1.0-ci1033
3.1.0-ci1034
3.1.0-ci1035
3.1.0-ci1036
3.1.0-ci1037
3.1.0-ci1038
3.1.0-ci1043
3.1.0-ci1044
3.1.0-ci1045
3.1.0-ci1046
3.1.0-ci1047
3.1.0-ci1048
3.1.0-ci1049
3.1.0-ci1050
3.1.0-ci1051
3.1.0-ci1053
3.1.0-ci1056
3.1.0-ci1058
3.1.1
3.1.1-ci1000
3.1.1-ci1003
3.2.0
3.2.0-ci1000
3.2.0-ci1001
3.2.0-ci1002
3.2.0-ci1003
3.2.0-ci1004
3.2.0-ci1005
3.2.0-ci1008
3.2.0-ci1009
3.2.0-ci1010
3.2.0-ci1011
3.2.0-ci1014
3.2.0-ci1015
3.2.0-ci1016
3.2.0-ci1017
3.2.0-ci1021
3.2.0-ci1022
3.2.0-ci1023
3.2.0-ci1024
3.2.0-ci1025
3.2.0-ci1026
3.2.0-ci1027
3.2.0-ci1028
3.2.0-ci1029
3.2.0-ci1030
3.2.0-ci1033
3.2.0-ci1034
3.2.0-ci1035
3.2.0-ci1036
3.2.0-ci1037
3.2.0-ci1038
3.2.0-ci1039
3.2.0-ci1040
3.2.0-ci1041
3.2.0-ci1042
3.2.0-ci1043
3.2.1
3.2.1-ci1000
3.2.1-ci1001
3.2.1-ci1002
3.3.0
3.3.0-ci1000
3.3.0-ci1001
3.3.0-ci1002
3.3.0-ci1003
3.3.0-ci1004
3.3.0-ci1005
3.3.0-ci1006
3.3.0-ci1007
3.3.0-ci1008
3.3.0-ci1009
3.3.0-ci1016
3.3.0-ci1017
3.3.0-ci1018
3.3.0-ci1019
3.3.0-ci1020
3.3.0-ci1021
3.3.0-ci1022
3.3.0-ci1023
3.3.0-ci1024
3.3.0-ci1025
3.3.0-ci1026
3.3.0-ci1027
3.3.0-ci1028
3.3.0-ci1029
3.3.0-ci1030
3.3.0-ci1031
3.3.0-ci1032
3.3.0-ci1033
3.3.1
4.0.0
4.0.0-alpha1
4.0.0-ci1002
4.0.0-ci1004
4.0.0-ci1006
4.0.0-ci1007
4.0.0-ci1014
4.0.0-ci1015
4.0.0-ci1017
4.0.0-ci1018
4.0.0-ci1019
4.0.0-ci1020
4.0.0-ci1021
4.0.0-ci1026
4.0.0-ci1031
4.0.0-ci1032
4.0.0-ci1034
4.0.0-ci1036
4.0.0-ci1038
4.0.0-ci1046
4.0.0-ci1049
4.0.0-ci1050
4.0.0-ci1051
4.0.0-ci1052
4.0.0-ci1053
4.0.0-ci1054
4.0.0-ci1056
4.0.0-ci1057
4.0.0-ci1061
4.0.1
4.0.2
4.0.3
4.0.4
4.1.0
4.1.1
4.2.0
4.2.1
5.0.0
5.0.0-beta-1
5.0.1
5.0.2
5.1.0
5.1.1
5.2.0
6.0.0
6.0.1
6.0.2
6.1.0
6.1.1
6.2.0
6.2.1
6.2.2
7.0.0
7.0.0-alpha-0001
7.0.1
8.0.0
8.1.0
8.1.1
9.0.0
Fixed in
15.1.1
16.1.1
References
Updated Sep 10, 2026 · Source: OSV.dev |
2.1.265
patch
|