CVE-2026-32933 AutoMapper Vulnerable to Denial of Service (DoS) via Uncontrolled Recursion
Attackers can crash the application by providing deeply nested object graphs to AutoMapper, causing a stack overflow and process termination.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-32933?
CVE-2026-32933 is a high-severity denial of service vulnerability in LuckyPennySoftware AutoMapper, published on 20 Mar 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
AutoMapper is a convention-based object-object mapper in .NET. Versions prior to 15.1.1 and 16.1.1 are vulnerable to a Denial of Service (DoS) attack. When mapping deeply nested object graphs, the library uses recursive method calls without enforcing a default maximum depth limit. This allows an attacker to provide a specially crafted object graph that exhausts the thread's stack memory, triggering a `StackOverflowException` and causing the entire application process to terminate. Versions 15.1.1 and 16.1.1 fix the issue.
Weakness: CWE-674
Which versions are affected by CVE-2026-32933?
4 open source packages ship an affected version, including AutoMapper. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
AutoMapper NuGet | All versions | 15.1.1 |
AutoMapper NuGet | All versions | 15.1.1 |
AutoMapper NuGet | From 16.0.0 | 16.1.1 |
AutoMapper NuGet | From 16.0.0 | 16.1.1 |
Products include Luckypennysoftware Automapper.
How do I fix CVE-2026-32933?
Upgrade AutoMapper to a fixed version for your release line: 15.1.1 or 16.1.1.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-32933 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-32933 exists.
Sources
Also known as ECHO-7df6-9160-2309, GHSA-rvv3-g6hj-g44x.