CVE-2026-32933: 
C# vulnerability analysis and mitigation

CVE-2026-32933 is a Denial of Service (DoS) vulnerability in AutoMapper, a convention-based object-object mapper for .NET, caused by uncontrolled recursion when mapping deeply nested object graphs. The vulnerability affects all versions prior to 15.1.1 and versions 16.0.0 through 16.1.0 (prior to 16.1.1). It was disclosed by researcher @skdishansachin via responsible disclosure and published on March 13–20, 2026. The CVSS v3.1 base score is 7.5 (High) (GitHub Advisory, Feedly).

The root cause is CWE-674 (Uncontrolled Recursion): AutoMapper's core mapping engine recursively maps object properties without enforcing a default maximum recursion depth. When a source object contains a self-referential property (e.g., a Circular class with a Self property of the same type), the mapper descends into each level indefinitely. In standard .NET environments, approximately 25,000–30,000 levels of nesting are sufficient to exhaust the thread's stack memory, triggering a StackOverflowException. Because StackOverflowException cannot be caught in modern .NET runtimes, the entire application process terminates immediately with no possibility of recovery. A proof-of-concept is included in the official advisory, demonstrating the crash by constructing a 30,000-level nested object graph and calling mapper.Map() (GitHub Advisory, Patch Commit).

Successful exploitation results in complete process termination of the hosting application, causing a full Denial of Service. Unlike standard unhandled exceptions, a StackOverflowException cannot be caught or handled, meaning the entire application server process crashes — not just the individual request thread — affecting all concurrent users and requests. There is no confidentiality or integrity impact; the vulnerability is limited to availability. Any .NET application that accepts untrusted or attacker-controlled input and passes it through an AutoMapper mapping path involving self-referential types is at risk (GitHub Advisory).

1. Reconnaissance: Identify target .NET web applications or APIs that use AutoMapper (versions < 15.1.1 or 16.0.0–16.1.0) and accept user-supplied structured data (e.g., JSON payloads) that is deserialized and passed to mapper.Map().
2. Identify vulnerable mapping paths: Determine if the application maps self-referential or deeply nestable object types (e.g., tree structures, linked lists, hierarchical models) through AutoMapper.
3. Craft malicious payload: Construct a deeply nested object graph — approximately 25,000–30,000+ levels — in the format accepted by the target API endpoint (e.g., a deeply nested JSON object corresponding to a self-referential type).
4. Submit the payload: Send the crafted payload to the target endpoint via HTTP POST or other accepted method. The application deserializes the input and passes it to mapper.Map().
5. Trigger StackOverflowException: AutoMapper recursively maps each level without a depth limit, exhausting the thread stack and triggering an uncatchable StackOverflowException, which immediately terminates the entire application process.
6. Result: The application server crashes, causing a complete Denial of Service for all users until the process is restarted (GitHub Advisory).

• Logs: Sudden application crash logs or Windows Event Log entries indicating an unhandled StackOverflowException in the .NET runtime; IIS/Kestrel/application host logs showing unexpected process termination without a graceful shutdown message.
• Network: Repeated HTTP requests to API endpoints that accept nested structured data (e.g., JSON with deeply recursive fields), particularly requests with unusually large or deeply nested payloads.
• Process: Abrupt termination of the .NET application worker process (e.g., w3wp.exe, dotnet.exe) without a corresponding graceful shutdown event; process restart events in application monitoring tools shortly after receiving specific requests.
• Application Monitoring: Spikes in request payload size or nesting depth correlated with application crashes; alerts from APM tools (e.g., Application Insights, Datadog) indicating process-level crashes rather than handled exceptions (GitHub Advisory).

Upgrade AutoMapper to version 15.1.1 (for the v15 branch) or 16.1.1 (for the v16 branch), which apply a default MaxDepth of 64 for self-referential type mappings — matching the defaults used by System.Text.Json and Newtonsoft.Json (v15.1.1 Release, v16.1.1 Release). If upgrading immediately is not possible, developers can manually configure MaxDepth in their mapping configuration: cfg.CreateMap<T, T>().MaxDepth(64);. Applications that legitimately require deeper mapping can increase the limit explicitly with .MaxDepth(n), or disable the depth limit entirely by calling .PreserveReferences() explicitly (Patch Commit). Additionally, input validation to reject excessively nested payloads at the API boundary is recommended as a defense-in-depth measure.

The vulnerability was responsibly disclosed by researcher @skdishansachin and acknowledged by AutoMapper maintainer @jbogard, who released patches for both supported branches within days of the advisory publication (v16.1.1 Release, v15.1.1 Release). The issue received coverage from security aggregators including CVEFeed, VulDB, and Mastodon security accounts, reflecting moderate community interest given AutoMapper's widespread use in the .NET ecosystem. No significant controversy or major media coverage was noted beyond standard vulnerability tracking and advisory dissemination.