CVE-2026-128081

AutoMapper is a convention-based object-object mapper in .NET. Prior to 15.1.4 and from 16.0.0 until 16.3.0, AutoMapper can recurse without an effective MaxDepth limit when mapping polymorphic graphs through Include or IncludeBase, runtime-typed object or interface members, nested Dictionary<string, object> or ExpandoObject sources, or recursive ConvertUsing type converters. Deep attacker-influenced graphs on these paths can throw an uncatchable StackOverflowException and terminate the process. This issue is fixed in versions 15.1.4 and 16.3.0.

• CWE-674

• https://github.com/LuckyPennySoftware/AutoMapper/commit/aee81b50574c3c7005283cca2b2396e295bd8ed9
• https://github.com/LuckyPennySoftware/AutoMapper/commit/bdbbf5967d20d28e611ab65de1d96d1047a95ab9
• https://github.com/LuckyPennySoftware/AutoMapper/releases/tag/v15.1.4
• https://github.com/LuckyPennySoftware/AutoMapper/releases/tag/v16.3.0
• https://github.com/LuckyPennySoftware/AutoMapper/security/advisories/GHSA-gpwp-5797-mjff

Published

Nov 13, 2026

Last Modified

Nov 13, 2026

Status

Received

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-128076Nuxt is an open-source web development framework for Vue.js.…3.1
• CVE-2026-128077Nuxt is an open-source web development framework for Vue.js.…6.5
• CVE-2026-128078GLPI is a free asset and IT management software package. Fro…5.3
• CVE-2026-128079envd provides reproducible development environments for huma…6.8
• CVE-2026-12808A vulnerability was determined in Edimax BR-6478AC V2 1.23. …6.3
• CVE-2026-128080OpenTelemetry JavaScript is the OpenTelemetry JavaScript cli…5.8
• CVE-2026-128082AutoMapper is a convention-based object-object mapper in .NE…7.5
• CVE-2026-128083Laravel is a web application framework. Prior to 12.71.0 and…2.3
• CVE-2026-128084sqlite3 provides Ruby bindings for the SQLite3 embedded data…4.8
• CVE-2026-128085OpenTelemetry-Go is the Go implementation of OpenTelemetry. …5.3
• CVE-2026-128086OpenTelemetry-Go is the Go implementation of OpenTelemetry. …5.3
• CVE-2026-128087russh is a Rust SSH client and server library that includes …3.7