{"affected":[{"product":"AutoMapper","source":"CNA: GitHub_M","vendor":"LuckyPennySoftware","versions":[{"status":"affected","version":">= 16.0.0, < 16.3.0"},{"status":"affected","version":"< 15.1.4"}]},{"defaultStatus":"unaffected","ecosystem":"NuGet","packageName":"AutoMapper","product":"AutoMapper","source":"OSV GHSA-gpwp-5797-mjff","vendor":"","versions":[{"status":"affected","version":"16.0.0","versionType":"NuGet"},{"status":"affected","version":"16.1.0","versionType":"NuGet"},{"status":"affected","version":"16.1.1","versionType":"NuGet"},{"status":"affected","version":"16.2.0","versionType":"NuGet"},{"events":[{"introduced":"16.0.0"},{"fixed":"16.3.0"}],"status":"unknown","version":"16.0.0","versionType":"ECOSYSTEM"}]},{"defaultStatus":"unaffected","ecosystem":"NuGet","packageName":"AutoMapper","product":"AutoMapper","source":"OSV GHSA-gpwp-5797-mjff","vendor":"","versions":[{"status":"affected","version":"1.1.0.118","versionType":"NuGet"},{"status":"affected","version":"1.1.1","versionType":"NuGet"},{"status":"affected","version":"1.1.2","versionType":"NuGet"},{"status":"affected","version":"10.0.0","versionType":"NuGet"},{"status":"affected","version":"10.1.0","versionType":"NuGet"},{"status":"affected","version":"10.1.1","versionType":"NuGet"},{"status":"affected","version":"11.0.0","versionType":"NuGet"},{"status":"affected","version":"11.0.1","versionType":"NuGet"},{"status":"affected","version":"12.0.0","versionType":"NuGet"},{"status":"affected","version":"12.0.1","versionType":"NuGet"},{"status":"affected","version":"13.0.0","versionType":"NuGet"},{"status":"affected","version":"13.0.1","versionType":"NuGet"},{"status":"affected","version":"14.0.0","versionType":"NuGet"},{"status":"affected","version":"15.0.0","versionType":"NuGet"},{"status":"affected","version":"15.0.1","versionType":"NuGet"},{"status":"affected","version":"15.1.0","versionType":"NuGet"},{"status":"affected","version":"15.1.1","versionType":"NuGet"},{"status":"affected","version":"15.1.2","versionType":"NuGet"},{"status":"affected","version":"15.1.3","versionType":"NuGet"},{"status":"affected","version":"2.0.0","versionType":"NuGet"},{"status":"affected","version":"2.1.1","versionType":"NuGet"},{"status":"affected","version":"2.1.262","versionType":"NuGet"},{"status":"affected","version":"2.1.265","versionType":"NuGet"},{"status":"affected","version":"2.1.266","versionType":"NuGet"},{"status":"affected","version":"2.1.267","versionType":"NuGet"},{"status":"affected","version":"2.2.0","versionType":"NuGet"},{"status":"affected","version":"2.2.1","versionType":"NuGet"},{"status":"affected","version":"2.2.1-ci10","versionType":"NuGet"},{"status":"affected","version":"2.2.1-ci1000","versionType":"NuGet"},{"status":"affected","version":"2.2.1-ci11","versionType":"NuGet"},{"status":"affected","version":"2.2.1-ci15","versionType":"NuGet"},{"status":"affected","version":"2.2.1-ci16","versionType":"NuGet"},{"status":"affected","version":"2.2.1-ci17","versionType":"NuGet"},{"status":"affected","version":"2.2.1-ci4","versionType":"NuGet"},{"status":"affected","version":"2.2.1-ci5","versionType":"NuGet"},{"status":"affected","version":"2.2.1-ci6","versionType":"NuGet"},{"status":"affected","version":"2.2.1-ci7","versionType":"NuGet"},{"status":"affected","version":"2.2.1-ci8","versionType":"NuGet"},{"status":"affected","version":"2.2.1-ci9","versionType":"NuGet"},{"status":"affected","version":"2.2.1-ci9000","versionType":"NuGet"},{"status":"affected","version":"2.2.1-ci9001","versionType":"NuGet"},{"status":"affected","version":"2.2.1-ci9002","versionType":"NuGet"},{"status":"affected","version":"2.2.1-ci9003","versionType":"NuGet"},{"status":"affected","version":"2.2.1-ci9004","versionType":"NuGet"},{"status":"affected","version":"2.2.1-ci9005","versionType":"NuGet"},{"status":"affected","version":"2.2.1-ci9006","versionType":"NuGet"},{"status":"affected","version":"2.2.24-ci","versionType":"NuGet"},{"status":"affected","version":"2.2.25-ci","versionType":"NuGet"},{"status":"affected","version":"3.0.0","versionType":"NuGet"},{"status":"affected","version":"3.0.0-ci1026","versionType":"NuGet"},{"status":"affected","version":"3.0.0-ci1028","versionType":"NuGet"},{"status":"affected","version":"3.0.0-ci1029","versionType":"NuGet"},{"status":"affected","version":"3.0.0-ci1031","versionType":"NuGet"},{"status":"affected","version":"3.0.0-ci1032","versionType":"NuGet"},{"status":"affected","version":"3.0.0-ci1033","versionType":"NuGet"},{"status":"affected","version":"3.0.0-ci1034","versionType":"NuGet"},{"status":"affected","version":"3.0.0-ci1035","versionType":"NuGet"},{"status":"affected","version":"3.0.0-ci1036","versionType":"NuGet"},{"status":"affected","version":"3.0.0-ci1037","versionType":"NuGet"},{"status":"affected","version":"3.0.0-ci1038","versionType":"NuGet"},{"status":"affected","version":"3.0.0-ci1039","versionType":"NuGet"},{"status":"affected","version":"3.0.0-ci1040","versionType":"NuGet"},{"status":"affected","version":"3.0.0-ci1041","versionType":"NuGet"},{"status":"affected","version":"3.0.0-ci1042","versionType":"NuGet"},{"status":"affected","version":"3.0.0-ci1043","versionType":"NuGet"},{"status":"affected","version":"3.0.0-ci1053","versionType":"NuGet"},{"status":"affected","version":"3.1.0","versionType":"NuGet"},{"status":"affected","version":"3.1.0-ci1014","versionType":"NuGet"},{"status":"affected","version":"3.1.0-ci1016","versionType":"NuGet"},{"status":"affected","version":"3.1.0-ci1017","versionType":"NuGet"},{"status":"affected","version":"3.1.0-ci1018","versionType":"NuGet"},{"status":"affected","version":"3.1.0-ci1019","versionType":"NuGet"},{"status":"affected","version":"3.1.0-ci1020","versionType":"NuGet"},{"status":"affected","version":"3.1.0-ci1021","versionType":"NuGet"},{"status":"affected","version":"3.1.0-ci1022","versionType":"NuGet"},{"status":"affected","version":"3.1.0-ci1023","versionType":"NuGet"},{"status":"affected","version":"3.1.0-ci1024","versionType":"NuGet"},{"status":"affected","version":"3.1.0-ci1026","versionType":"NuGet"},{"status":"affected","version":"3.1.0-ci1027","versionType":"NuGet"},{"status":"affected","version":"3.1.0-ci1032","versionType":"NuGet"},{"status":"affected","version":"3.1.0-ci1033","versionType":"NuGet"},{"status":"affected","version":"3.1.0-ci1034","versionType":"NuGet"},{"status":"affected","version":"3.1.0-ci1035","versionType":"NuGet"},{"status":"affected","version":"3.1.0-ci1036","versionType":"NuGet"},{"status":"affected","version":"3.1.0-ci1037","versionType":"NuGet"},{"status":"affected","version":"3.1.0-ci1038","versionType":"NuGet"},{"status":"affected","version":"3.1.0-ci1043","versionType":"NuGet"},{"status":"affected","version":"3.1.0-ci1044","versionType":"NuGet"},{"status":"affected","version":"3.1.0-ci1045","versionType":"NuGet"},{"status":"affected","version":"3.1.0-ci1046","versionType":"NuGet"},{"status":"affected","version":"3.1.0-ci1047","versionType":"NuGet"},{"status":"affected","version":"3.1.0-ci1048","versionType":"NuGet"},{"status":"affected","version":"3.1.0-ci1049","versionType":"NuGet"},{"status":"affected","version":"3.1.0-ci1050","versionType":"NuGet"},{"status":"affected","version":"3.1.0-ci1051","versionType":"NuGet"},{"status":"affected","version":"3.1.0-ci1053","versionType":"NuGet"},{"status":"affected","version":"3.1.0-ci1056","versionType":"NuGet"},{"status":"affected","version":"3.1.0-ci1058","versionType":"NuGet"},{"status":"affected","version":"3.1.1","versionType":"NuGet"},{"status":"affected","version":"3.1.1-ci1000","versionType":"NuGet"},{"status":"affected","version":"3.1.1-ci1003","versionType":"NuGet"},{"status":"affected","version":"3.2.0","versionType":"NuGet"},{"status":"affected","version":"3.2.0-ci1000","versionType":"NuGet"},{"status":"affected","version":"3.2.0-ci1001","versionType":"NuGet"},{"status":"affected","version":"3.2.0-ci1002","versionType":"NuGet"},{"status":"affected","version":"3.2.0-ci1003","versionType":"NuGet"},{"status":"affected","version":"3.2.0-ci1004","versionType":"NuGet"},{"status":"affected","version":"3.2.0-ci1005","versionType":"NuGet"},{"status":"affected","version":"3.2.0-ci1008","versionType":"NuGet"},{"status":"affected","version":"3.2.0-ci1009","versionType":"NuGet"},{"status":"affected","version":"3.2.0-ci1010","versionType":"NuGet"},{"status":"affected","version":"3.2.0-ci1011","versionType":"NuGet"},{"status":"affected","version":"3.2.0-ci1014","versionType":"NuGet"},{"status":"affected","version":"3.2.0-ci1015","versionType":"NuGet"},{"status":"affected","version":"3.2.0-ci1016","versionType":"NuGet"},{"status":"affected","version":"3.2.0-ci1017","versionType":"NuGet"},{"status":"affected","version":"3.2.0-ci1021","versionType":"NuGet"},{"status":"affected","version":"3.2.0-ci1022","versionType":"NuGet"},{"status":"affected","version":"3.2.0-ci1023","versionType":"NuGet"},{"status":"affected","version":"3.2.0-ci1024","versionType":"NuGet"},{"status":"affected","version":"3.2.0-ci1025","versionType":"NuGet"},{"status":"affected","version":"3.2.0-ci1026","versionType":"NuGet"},{"status":"affected","version":"3.2.0-ci1027","versionType":"NuGet"},{"status":"affected","version":"3.2.0-ci1028","versionType":"NuGet"},{"status":"affected","version":"3.2.0-ci1029","versionType":"NuGet"},{"status":"affected","version":"3.2.0-ci1030","versionType":"NuGet"},{"status":"affected","version":"3.2.0-ci1033","versionType":"NuGet"},{"status":"affected","version":"3.2.0-ci1034","versionType":"NuGet"},{"status":"affected","version":"3.2.0-ci1035","versionType":"NuGet"},{"status":"affected","version":"3.2.0-ci1036","versionType":"NuGet"},{"status":"affected","version":"3.2.0-ci1037","versionType":"NuGet"},{"status":"affected","version":"3.2.0-ci1038","versionType":"NuGet"},{"status":"affected","version":"3.2.0-ci1039","versionType":"NuGet"},{"status":"affected","version":"3.2.0-ci1040","versionType":"NuGet"},{"status":"affected","version":"3.2.0-ci1041","versionType":"NuGet"},{"status":"affected","version":"3.2.0-ci1042","versionType":"NuGet"},{"status":"affected","version":"3.2.0-ci1043","versionType":"NuGet"},{"status":"affected","version":"3.2.1","versionType":"NuGet"},{"status":"affected","version":"3.2.1-ci1000","versionType":"NuGet"},{"status":"affected","version":"3.2.1-ci1001","versionType":"NuGet"},{"status":"affected","version":"3.2.1-ci1002","versionType":"NuGet"},{"status":"affected","version":"3.3.0","versionType":"NuGet"},{"status":"affected","version":"3.3.0-ci1000","versionType":"NuGet"},{"status":"affected","version":"3.3.0-ci1001","versionType":"NuGet"},{"status":"affected","version":"3.3.0-ci1002","versionType":"NuGet"},{"status":"affected","version":"3.3.0-ci1003","versionType":"NuGet"},{"status":"affected","version":"3.3.0-ci1004","versionType":"NuGet"},{"status":"affected","version":"3.3.0-ci1005","versionType":"NuGet"},{"status":"affected","version":"3.3.0-ci1006","versionType":"NuGet"},{"status":"affected","version":"3.3.0-ci1007","versionType":"NuGet"},{"status":"affected","version":"3.3.0-ci1008","versionType":"NuGet"},{"status":"affected","version":"3.3.0-ci1009","versionType":"NuGet"},{"status":"affected","version":"3.3.0-ci1016","versionType":"NuGet"},{"status":"affected","version":"3.3.0-ci1017","versionType":"NuGet"},{"status":"affected","version":"3.3.0-ci1018","versionType":"NuGet"},{"status":"affected","version":"3.3.0-ci1019","versionType":"NuGet"},{"status":"affected","version":"3.3.0-ci1020","versionType":"NuGet"},{"status":"affected","version":"3.3.0-ci1021","versionType":"NuGet"},{"status":"affected","version":"3.3.0-ci1022","versionType":"NuGet"},{"status":"affected","version":"3.3.0-ci1023","versionType":"NuGet"},{"status":"affected","version":"3.3.0-ci1024","versionType":"NuGet"},{"status":"affected","version":"3.3.0-ci1025","versionType":"NuGet"},{"status":"affected","version":"3.3.0-ci1026","versionType":"NuGet"},{"status":"affected","version":"3.3.0-ci1027","versionType":"NuGet"},{"status":"affected","version":"3.3.0-ci1028","versionType":"NuGet"},{"status":"affected","version":"3.3.0-ci1029","versionType":"NuGet"},{"status":"affected","version":"3.3.0-ci1030","versionType":"NuGet"},{"status":"affected","version":"3.3.0-ci1031","versionType":"NuGet"},{"status":"affected","version":"3.3.0-ci1032","versionType":"NuGet"},{"status":"affected","version":"3.3.0-ci1033","versionType":"NuGet"},{"status":"affected","version":"3.3.1","versionType":"NuGet"},{"status":"affected","version":"4.0.0","versionType":"NuGet"},{"status":"affected","version":"4.0.0-alpha1","versionType":"NuGet"},{"status":"affected","version":"4.0.0-ci1002","versionType":"NuGet"},{"status":"affected","version":"4.0.0-ci1004","versionType":"NuGet"},{"status":"affected","version":"4.0.0-ci1006","versionType":"NuGet"},{"status":"affected","version":"4.0.0-ci1007","versionType":"NuGet"},{"status":"affected","version":"4.0.0-ci1014","versionType":"NuGet"},{"status":"affected","version":"4.0.0-ci1015","versionType":"NuGet"},{"status":"affected","version":"4.0.0-ci1017","versionType":"NuGet"},{"status":"affected","version":"4.0.0-ci1018","versionType":"NuGet"},{"status":"affected","version":"4.0.0-ci1019","versionType":"NuGet"},{"status":"affected","version":"4.0.0-ci1020","versionType":"NuGet"},{"status":"affected","version":"4.0.0-ci1021","versionType":"NuGet"},{"status":"affected","version":"4.0.0-ci1026","versionType":"NuGet"},{"status":"affected","version":"4.0.0-ci1031","versionType":"NuGet"},{"status":"affected","version":"4.0.0-ci1032","versionType":"NuGet"},{"status":"affected","version":"4.0.0-ci1034","versionType":"NuGet"},{"status":"affected","version":"4.0.0-ci1036","versionType":"NuGet"},{"status":"affected","version":"4.0.0-ci1038","versionType":"NuGet"},{"status":"affected","version":"4.0.0-ci1046","versionType":"NuGet"},{"status":"affected","version":"4.0.0-ci1049","versionType":"NuGet"},{"status":"affected","version":"4.0.0-ci1050","versionType":"NuGet"},{"status":"affected","version":"4.0.0-ci1051","versionType":"NuGet"},{"status":"affected","version":"4.0.0-ci1052","versionType":"NuGet"},{"status":"affected","version":"4.0.0-ci1053","versionType":"NuGet"},{"status":"affected","version":"4.0.0-ci1054","versionType":"NuGet"},{"status":"affected","version":"4.0.0-ci1056","versionType":"NuGet"},{"status":"affected","version":"4.0.0-ci1057","versionType":"NuGet"},{"status":"affected","version":"4.0.0-ci1061","versionType":"NuGet"},{"status":"affected","version":"4.0.1","versionType":"NuGet"},{"status":"affected","version":"4.0.2","versionType":"NuGet"},{"status":"affected","version":"4.0.3","versionType":"NuGet"},{"status":"affected","version":"4.0.4","versionType":"NuGet"},{"status":"affected","version":"4.1.0","versionType":"NuGet"},{"status":"affected","version":"4.1.1","versionType":"NuGet"},{"status":"affected","version":"4.2.0","versionType":"NuGet"},{"status":"affected","version":"4.2.1","versionType":"NuGet"},{"status":"affected","version":"5.0.0","versionType":"NuGet"},{"status":"affected","version":"5.0.0-beta-1","versionType":"NuGet"},{"status":"affected","version":"5.0.1","versionType":"NuGet"},{"status":"affected","version":"5.0.2","versionType":"NuGet"},{"status":"affected","version":"5.1.0","versionType":"NuGet"},{"status":"affected","version":"5.1.1","versionType":"NuGet"},{"status":"affected","version":"5.2.0","versionType":"NuGet"},{"status":"affected","version":"6.0.0","versionType":"NuGet"},{"status":"affected","version":"6.0.1","versionType":"NuGet"},{"status":"affected","version":"6.0.2","versionType":"NuGet"},{"status":"affected","version":"6.1.0","versionType":"NuGet"},{"status":"affected","version":"6.1.1","versionType":"NuGet"},{"status":"affected","version":"6.2.0","versionType":"NuGet"},{"status":"affected","version":"6.2.1","versionType":"NuGet"},{"status":"affected","version":"6.2.2","versionType":"NuGet"},{"status":"affected","version":"7.0.0","versionType":"NuGet"},{"status":"affected","version":"7.0.0-alpha-0001","versionType":"NuGet"},{"status":"affected","version":"7.0.1","versionType":"NuGet"},{"status":"affected","version":"8.0.0","versionType":"NuGet"},{"status":"affected","version":"8.1.0","versionType":"NuGet"},{"status":"affected","version":"8.1.1","versionType":"NuGet"},{"status":"affected","version":"9.0.0","versionType":"NuGet"},{"events":[{"introduced":"0"},{"fixed":"15.1.4"}],"status":"unknown","version":"0","versionType":"ECOSYSTEM"}]}],"cveId":"CVE-2026-128081","cwes":["CWE-674"],"description":"AutoMapper is a convention-based object-object mapper in .NET. Prior to 15.1.4 and from 16.0.0 until 16.3.0, AutoMapper can recurse without an effective MaxDepth limit when mapping polymorphic graphs through Include or IncludeBase, runtime-typed object or interface members, nested Dictionary<string, object> or ExpandoObject sources, or recursive ConvertUsing type converters. Deep attacker-influenced graphs on these paths can throw an uncatchable StackOverflowException and terminate the process. This issue is fixed in versions 15.1.4 and 16.3.0.","epss":null,"exploits":[],"kev":null,"metrics":[{"score":7.5,"severity":"high","source":"CNA: GitHub_M","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"}],"modifiedAt":1794597307330,"publishedAt":1794594945452,"references":[{"source":"CNA: GitHub_M","tags":["x_refsource_CONFIRM"],"url":"https://github.com/LuckyPennySoftware/AutoMapper/security/advisories/GHSA-gpwp-5797-mjff"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/LuckyPennySoftware/AutoMapper/commit/aee81b50574c3c7005283cca2b2396e295bd8ed9"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/LuckyPennySoftware/AutoMapper/commit/bdbbf5967d20d28e611ab65de1d96d1047a95ab9"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/LuckyPennySoftware/AutoMapper/releases/tag/v15.1.4"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/LuckyPennySoftware/AutoMapper/releases/tag/v16.3.0"},{"source":"OSV / GitHub Security Advisories","tags":["advisory"],"url":"https://github.com/advisories/GHSA-gpwp-5797-mjff"},{"source":"OSV / GitHub Security Advisories","tags":["osv"],"url":"https://osv.dev/vulnerability/GHSA-gpwp-5797-mjff"}],"remediation":[{"kind":"fix","source":"OSV GHSA-gpwp-5797-mjff","text":"AutoMapper (NuGet): OSV reports a fixed version 16.3.0. Check the advisory for supported release branches.","url":"https://github.com/advisories/GHSA-gpwp-5797-mjff"},{"kind":"fix","source":"OSV GHSA-gpwp-5797-mjff","text":"AutoMapper (NuGet): OSV reports a fixed version 15.1.4. Check the advisory for supported release branches.","url":"https://github.com/advisories/GHSA-gpwp-5797-mjff"}],"revision":"129297a0d1833fbf842c0f181564026a8baaba0bf4984a38803f00939758c876","sources":[{"modifiedAt":1794594945452,"name":"CNA: GitHub_M","retrievedAt":1794597918629,"url":"https://www.cve.org/CVERecord?id=CVE-2026-128081"},{"modifiedAt":1794597307330,"name":"OSV / GitHub Security Advisories","retrievedAt":1794597919410,"url":"https://osv.dev/vulnerability/GHSA-gpwp-5797-mjff"}],"ssvc":null,"status":"published","title":"AutoMapper: Denial of Service via uncontrolled recursion that bypasses MaxDepth","updatedAt":1794597919410}