CVE-2026-128081

{
  "etk_id": "ETK-2026-3642",
  "cve_id": "CVE-2026-128081",
  "display_id": "CVE-2026-128081",
  "ghsa_id": "GHSA-gpwp-5797-mjff",
  "euvd_id": "EUVD-2026-125688",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Unbounded recursion in AutoMapper mappings",
  "summary": "AutoMapper releases before 15.1.4, and releases from 16.0.0 before 16.3.0, may not enforce mapping-depth limits for certain polymorphic, runtime-typed, dictionary or dynamic, and recursive-converter mappings. An attacker who can provide deeply nested data to one of these mapping paths may terminate the application process through stack exhaustion.",
  "mitigation": "Upgrade AutoMapper to 15.1.4 or 16.3.0 or later, as appropriate for the release line. Until upgraded, reject excessively nested input before mapping and configure explicit depth limits on applicable derived and runtime-typed maps.",
  "vendor": "nuget",
  "product": "nuget:AutoMapper",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 16.0.0, < 16.3.0"
      ],
      "ecosystem": "nuget",
      "fixed_versions": [
        "16.3.0"
      ],
      "package_name": "AutoMapper",
      "purl": "pkg:nuget/AutoMapper"
    },
    {
      "affected_notes": [],
      "affected_ranges": [
        "< 15.1.4"
      ],
      "ecosystem": "nuget",
      "fixed_versions": [
        "15.1.4"
      ],
      "package_name": "AutoMapper",
      "purl": "pkg:nuget/AutoMapper"
    }
  ],
  "cwes": [
    674
  ],
  "cvss_score": 7.5,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "contextual",
  "check": true,
  "check_confidence_basis": "assessed",
  "exploit": false,
  "pipeline_minutes": 7.572812466666667,
  "t0_at": "2026-11-13T18:35:45.452000+00:00",
  "signals": {
    "check": {
      "at": "2026-11-13T19:20:18.372836+00:00",
      "days": 0.03093658375,
      "is_lower_bound": false,
      "measured_at": "2026-11-13T18:35:45.452000+00:00",
      "url": null
    },
    "trigger_signal": {
      "at": "2026-11-05T15:34:49+00:00",
      "days": -8.125653379629629,
      "is_lower_bound": false,
      "measured_at": "2026-11-13T18:35:45.452000+00:00",
      "url": "https://github.com/LuckyPennySoftware/AutoMapper/security/advisories/GHSA-gpwp-5797-mjff"
    }
  }
}