# CVE-2026-128081: AutoMapper: Denial of Service via uncontrolled recursion that bypasses MaxDepth

Status: published. Published: 2026-11-13. Updated: 2026-11-13.

AutoMapper is a convention-based object-object mapper in .NET. Prior to 15.1.4 and from 16.0.0 until 16.3.0, AutoMapper can recurse without an effective MaxDepth limit when mapping polymorphic graphs through Include or IncludeBase, runtime-typed object or interface members, nested Dictionary<string, object> or ExpandoObject sources, or recursive ConvertUsing type converters. Deep attacker-influenced graphs on these paths can throw an uncatchable StackOverflowException and terminate the process. This issue is fixed in versions 15.1.4 and 16.3.0.

## Remediation

- fix: AutoMapper (NuGet): OSV reports a fixed version 16.3.0. Check the advisory for supported release branches. (source: OSV GHSA-gpwp-5797-mjff) — https://github.com/advisories/GHSA-gpwp-5797-mjff
- fix: AutoMapper (NuGet): OSV reports a fixed version 15.1.4. Check the advisory for supported release branches. (source: OSV GHSA-gpwp-5797-mjff) — https://github.com/advisories/GHSA-gpwp-5797-mjff

## Affected products and versions

- LuckyPennySoftware / AutoMapper: >= 16.0.0, < 16.3.0 (affected); < 15.1.4 (affected). Source: CNA: GitHub_M
-  / AutoMapper (AutoMapper): 16.0.0 (affected, NuGet); 16.1.0 (affected, NuGet); 16.1.1 (affected, NuGet); 16.2.0 (affected, NuGet); Ecosystem version events: introduced 16.0.0; fixed 16.3.0. Source: OSV GHSA-gpwp-5797-mjff
-  / AutoMapper (AutoMapper): 1.1.0.118 (affected, NuGet); 1.1.1 (affected, NuGet); 1.1.2 (affected, NuGet); 10.0.0 (affected, NuGet); 10.1.0 (affected, NuGet); 10.1.1 (affected, NuGet); 11.0.0 (affected, NuGet); 11.0.1 (affected, NuGet); 12.0.0 (affected, NuGet); 12.0.1 (affected, NuGet); 13.0.0 (affected, NuGet); 13.0.1 (affected, NuGet); 14.0.0 (affected, NuGet); 15.0.0 (affected, NuGet); 15.0.1 (affected, NuGet); 15.1.0 (affected, NuGet); 15.1.1 (affected, NuGet); 15.1.2 (affected, NuGet); 15.1.3 (affected, NuGet); 2.0.0 (affected, NuGet); 2.1.1 (affected, NuGet); 2.1.262 (affected, NuGet); 2.1.265 (affected, NuGet); 2.1.266 (affected, NuGet); 2.1.267 (affected, NuGet); 2.2.0 (affected, NuGet); 2.2.1 (affected, NuGet); 2.2.1-ci10 (affected, NuGet); 2.2.1-ci1000 (affected, NuGet); 2.2.1-ci11 (affected, NuGet); 2.2.1-ci15 (affected, NuGet); 2.2.1-ci16 (affected, NuGet); 2.2.1-ci17 (affected, NuGet); 2.2.1-ci4 (affected, NuGet); 2.2.1-ci5 (affected, NuGet); 2.2.1-ci6 (affected, NuGet); 2.2.1-ci7 (affected, NuGet); 2.2.1-ci8 (affected, NuGet); 2.2.1-ci9 (affected, NuGet); 2.2.1-ci9000 (affected, NuGet); 2.2.1-ci9001 (affected, NuGet); 2.2.1-ci9002 (affected, NuGet); 2.2.1-ci9003 (affected, NuGet); 2.2.1-ci9004 (affected, NuGet); 2.2.1-ci9005 (affected, NuGet); 2.2.1-ci9006 (affected, NuGet); 2.2.24-ci (affected, NuGet); 2.2.25-ci (affected, NuGet); 3.0.0 (affected, NuGet); 3.0.0-ci1026 (affected, NuGet); 3.0.0-ci1028 (affected, NuGet); 3.0.0-ci1029 (affected, NuGet); 3.0.0-ci1031 (affected, NuGet); 3.0.0-ci1032 (affected, NuGet); 3.0.0-ci1033 (affected, NuGet); 3.0.0-ci1034 (affected, NuGet); 3.0.0-ci1035 (affected, NuGet); 3.0.0-ci1036 (affected, NuGet); 3.0.0-ci1037 (affected, NuGet); 3.0.0-ci1038 (affected, NuGet); 3.0.0-ci1039 (affected, NuGet); 3.0.0-ci1040 (affected, NuGet); 3.0.0-ci1041 (affected, NuGet); 3.0.0-ci1042 (affected, NuGet); 3.0.0-ci1043 (affected, NuGet); 3.0.0-ci1053 (affected, NuGet); 3.1.0 (affected, NuGet); 3.1.0-ci1014 (affected, NuGet); 3.1.0-ci1016 (affected, NuGet); 3.1.0-ci1017 (affected, NuGet); 3.1.0-ci1018 (affected, NuGet); 3.1.0-ci1019 (affected, NuGet); 3.1.0-ci1020 (affected, NuGet); 3.1.0-ci1021 (affected, NuGet); 3.1.0-ci1022 (affected, NuGet); 3.1.0-ci1023 (affected, NuGet); 3.1.0-ci1024 (affected, NuGet); 3.1.0-ci1026 (affected, NuGet); 3.1.0-ci1027 (affected, NuGet); 3.1.0-ci1032 (affected, NuGet); 3.1.0-ci1033 (affected, NuGet); 3.1.0-ci1034 (affected, NuGet); 3.1.0-ci1035 (affected, NuGet); 3.1.0-ci1036 (affected, NuGet); 3.1.0-ci1037 (affected, NuGet); 3.1.0-ci1038 (affected, NuGet); 3.1.0-ci1043 (affected, NuGet); 3.1.0-ci1044 (affected, NuGet); 3.1.0-ci1045 (affected, NuGet); 3.1.0-ci1046 (affected, NuGet); 3.1.0-ci1047 (affected, NuGet); 3.1.0-ci1048 (affected, NuGet); 3.1.0-ci1049 (affected, NuGet); 3.1.0-ci1050 (affected, NuGet); 3.1.0-ci1051 (affected, NuGet); 3.1.0-ci1053 (affected, NuGet); 3.1.0-ci1056 (affected, NuGet); 3.1.0-ci1058 (affected, NuGet); 3.1.1 (affected, NuGet); 3.1.1-ci1000 (affected, NuGet); 3.1.1-ci1003 (affected, NuGet); 3.2.0 (affected, NuGet); 3.2.0-ci1000 (affected, NuGet); 3.2.0-ci1001 (affected, NuGet); 3.2.0-ci1002 (affected, NuGet); 3.2.0-ci1003 (affected, NuGet); 3.2.0-ci1004 (affected, NuGet); 3.2.0-ci1005 (affected, NuGet); 3.2.0-ci1008 (affected, NuGet); 3.2.0-ci1009 (affected, NuGet); 3.2.0-ci1010 (affected, NuGet); 3.2.0-ci1011 (affected, NuGet); 3.2.0-ci1014 (affected, NuGet); 3.2.0-ci1015 (affected, NuGet); 3.2.0-ci1016 (affected, NuGet); 3.2.0-ci1017 (affected, NuGet); 3.2.0-ci1021 (affected, NuGet); 3.2.0-ci1022 (affected, NuGet); 3.2.0-ci1023 (affected, NuGet); 3.2.0-ci1024 (affected, NuGet); 3.2.0-ci1025 (affected, NuGet); 3.2.0-ci1026 (affected, NuGet); 3.2.0-ci1027 (affected, NuGet); 3.2.0-ci1028 (affected, NuGet); 3.2.0-ci1029 (affected, NuGet); 3.2.0-ci1030 (affected, NuGet); 3.2.0-ci1033 (affected, NuGet); 3.2.0-ci1034 (affected, NuGet); 3.2.0-ci1035 (affected, NuGet); 3.2.0-ci1036 (affected, NuGet); 3.2.0-ci1037 (affected, NuGet); 3.2.0-ci1038 (affected, NuGet); 3.2.0-ci1039 (affected, NuGet); 3.2.0-ci1040 (affected, NuGet); 3.2.0-ci1041 (affected, NuGet); 3.2.0-ci1042 (affected, NuGet); 3.2.0-ci1043 (affected, NuGet); 3.2.1 (affected, NuGet); 3.2.1-ci1000 (affected, NuGet); 3.2.1-ci1001 (affected, NuGet); 3.2.1-ci1002 (affected, NuGet); 3.3.0 (affected, NuGet); 3.3.0-ci1000 (affected, NuGet); 3.3.0-ci1001 (affected, NuGet); 3.3.0-ci1002 (affected, NuGet); 3.3.0-ci1003 (affected, NuGet); 3.3.0-ci1004 (affected, NuGet); 3.3.0-ci1005 (affected, NuGet); 3.3.0-ci1006 (affected, NuGet); 3.3.0-ci1007 (affected, NuGet); 3.3.0-ci1008 (affected, NuGet); 3.3.0-ci1009 (affected, NuGet); 3.3.0-ci1016 (affected, NuGet); 3.3.0-ci1017 (affected, NuGet); 3.3.0-ci1018 (affected, NuGet); 3.3.0-ci1019 (affected, NuGet); 3.3.0-ci1020 (affected, NuGet); 3.3.0-ci1021 (affected, NuGet); 3.3.0-ci1022 (affected, NuGet); 3.3.0-ci1023 (affected, NuGet); 3.3.0-ci1024 (affected, NuGet); 3.3.0-ci1025 (affected, NuGet); 3.3.0-ci1026 (affected, NuGet); 3.3.0-ci1027 (affected, NuGet); 3.3.0-ci1028 (affected, NuGet); 3.3.0-ci1029 (affected, NuGet); 3.3.0-ci1030 (affected, NuGet); 3.3.0-ci1031 (affected, NuGet); 3.3.0-ci1032 (affected, NuGet); 3.3.0-ci1033 (affected, NuGet); 3.3.1 (affected, NuGet); 4.0.0 (affected, NuGet); 4.0.0-alpha1 (affected, NuGet); 4.0.0-ci1002 (affected, NuGet); 4.0.0-ci1004 (affected, NuGet); 4.0.0-ci1006 (affected, NuGet); 4.0.0-ci1007 (affected, NuGet); 4.0.0-ci1014 (affected, NuGet); 4.0.0-ci1015 (affected, NuGet); 4.0.0-ci1017 (affected, NuGet); 4.0.0-ci1018 (affected, NuGet); 4.0.0-ci1019 (affected, NuGet); 4.0.0-ci1020 (affected, NuGet); 4.0.0-ci1021 (affected, NuGet); 4.0.0-ci1026 (affected, NuGet); 4.0.0-ci1031 (affected, NuGet); 4.0.0-ci1032 (affected, NuGet); 4.0.0-ci1034 (affected, NuGet); 4.0.0-ci1036 (affected, NuGet); 4.0.0-ci1038 (affected, NuGet); 4.0.0-ci1046 (affected, NuGet); 4.0.0-ci1049 (affected, NuGet); 4.0.0-ci1050 (affected, NuGet); 4.0.0-ci1051 (affected, NuGet); 4.0.0-ci1052 (affected, NuGet); 4.0.0-ci1053 (affected, NuGet); 4.0.0-ci1054 (affected, NuGet); 4.0.0-ci1056 (affected, NuGet); 4.0.0-ci1057 (affected, NuGet); 4.0.0-ci1061 (affected, NuGet); 4.0.1 (affected, NuGet); 4.0.2 (affected, NuGet); 4.0.3 (affected, NuGet); 4.0.4 (affected, NuGet); 4.1.0 (affected, NuGet); 4.1.1 (affected, NuGet); 4.2.0 (affected, NuGet); 4.2.1 (affected, NuGet); 5.0.0 (affected, NuGet); 5.0.0-beta-1 (affected, NuGet); 5.0.1 (affected, NuGet); 5.0.2 (affected, NuGet); 5.1.0 (affected, NuGet); 5.1.1 (affected, NuGet); 5.2.0 (affected, NuGet); 6.0.0 (affected, NuGet); 6.0.1 (affected, NuGet); 6.0.2 (affected, NuGet); 6.1.0 (affected, NuGet); 6.1.1 (affected, NuGet); 6.2.0 (affected, NuGet); 6.2.1 (affected, NuGet); 6.2.2 (affected, NuGet); 7.0.0 (affected, NuGet); 7.0.0-alpha-0001 (affected, NuGet); 7.0.1 (affected, NuGet); 8.0.0 (affected, NuGet); 8.1.0 (affected, NuGet); 8.1.1 (affected, NuGet); 9.0.0 (affected, NuGet); Ecosystem version events: introduced 0; fixed 15.1.4. Source: OSV GHSA-gpwp-5797-mjff

## Severity and prioritization

- CVSS 3.1: 7.5 (high); CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H; source: CNA: GitHub_M

- CISA KEV: No listing in collected sources

- EPSS: Not available

- SSVC: Not available

- Weaknesses: CWE-674

## Exploit evidence

No exploit evidence in collected sources. This is not proof of no exploitation.

## References

- https://github.com/LuckyPennySoftware/AutoMapper/security/advisories/GHSA-gpwp-5797-mjff (CNA: GitHub_M; x_refsource_CONFIRM)

- https://github.com/LuckyPennySoftware/AutoMapper/commit/aee81b50574c3c7005283cca2b2396e295bd8ed9 (CNA: GitHub_M; x_refsource_MISC)

- https://github.com/LuckyPennySoftware/AutoMapper/commit/bdbbf5967d20d28e611ab65de1d96d1047a95ab9 (CNA: GitHub_M; x_refsource_MISC)

- https://github.com/LuckyPennySoftware/AutoMapper/releases/tag/v15.1.4 (CNA: GitHub_M; x_refsource_MISC)

- https://github.com/LuckyPennySoftware/AutoMapper/releases/tag/v16.3.0 (CNA: GitHub_M; x_refsource_MISC)

- https://github.com/advisories/GHSA-gpwp-5797-mjff (OSV / GitHub Security Advisories; advisory)

- https://osv.dev/vulnerability/GHSA-gpwp-5797-mjff (OSV / GitHub Security Advisories; osv)

## Provenance

- CNA: GitHub_M: https://www.cve.org/CVERecord?id=CVE-2026-128081; retrieved 2026-11-13; source updated 2026-11-13

- OSV / GitHub Security Advisories: https://osv.dev/vulnerability/GHSA-gpwp-5797-mjff; retrieved 2026-11-13; source updated 2026-11-13

Revision: 129297a0d1833fbf842c0f181564026a8baaba0bf4984a38803f00939758c876

Canonical: https://y2.dev/cve/CVE-2026-128081

## Agent and API access

Public CVE pages, Markdown, and JSON are free to read without an account or API key.

- Public catalog: https://y2.dev/cve/index.json. Follow nextCursor with the same search, filters, sort, and limit (1–100). A null cursor marks the end.

- WebMCP: search_cve_disclosures, get_cve_disclosure, get_cve_page_markdown, get_y2_cve_access. Available in compatible browsers.

- Cyber API: https://api.y2.dev/api/v2/cyber/cves and https://api.y2.dev/api/v2/cyber/cves/{cveId}.

- Y2 Pro or Elite: create a workspace API key with the intel:cyber scope and send Authorization: Bearer <Y2_API_KEY>. Setup: https://y2.dev/docs/api/create-key.

- x402: Pay per request without an account or API key. Omit Authorization, read the HTTP 402 PAYMENT-REQUIRED challenge, validate its current requirements, and retry with PAYMENT-SIGNATURE through an authorized payment client. These browser tools never make payments. Guide: https://y2.dev/docs/api/x402.

- OpenAPI: https://y2.dev/api/openapi.yaml. Agent access metadata: https://y2.dev/cve/agent.json.

Collected public records only. Check source status for coverage and freshness.