AutoMapper is a convention-based object-object mapper in .NET. Versions prior to 15.1.1 and 16.1.1 are vulnerable to a Denial of Service (DoS) attack. When mapping deeply nested object graphs, the library uses recursive method calls without enforcing a default maximum depth limit. This allows an attacker to provide a specially crafted object graph that exhausts the threads stack memory, triggering a StackOverflowException and causing the entire application process to terminate. Versions 15.1.1 and 16.1.1 fix the issue.
Weakness
The product does not properly control the amount of recursion that takes place, consuming excessive resources, such as allocated memory or the program stack.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Automapper | Luckypennysoftware | * | 15.1.1 (excluding) |
| Automapper | Luckypennysoftware | 16.0.0 (including) | 16.1.1 (excluding) |
Potential Mitigations
Related Attack Patterns
References
- https://github.com/LuckyPennySoftware/AutoMapper/commit/0afaf1e91648fca1a57512e94dd00a76ee016816
- https://github.com/LuckyPennySoftware/AutoMapper/releases/tag/v15.1.1
- https://github.com/LuckyPennySoftware/AutoMapper/releases/tag/v16.1.1
- https://github.com/LuckyPennySoftware/AutoMapper/security/advisories/GHSA-rvv3-g6hj-g44x