[deps]: Update AutoMapper to v16 [SECURITY]

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
AutoMapper (source)	[14.0.0] → [16.1.1]

---

AutoMapper Vulnerable to Denial of Service (DoS) via Uncontrolled Recursion

CVE-2026-32933 / GHSA-rvv3-g6hj-g44x

More information

Details

Summary

AutoMapper is vulnerable to a Denial of Service (DoS) attack. When mapping deeply nested object graphs, the library uses recursive method calls without enforcing a default maximum depth limit. This allows an attacker to provide a specially crafted object graph that exhausts the thread's stack memory, triggering a StackOverflowException and causing the entire application process to terminate.

Description

The vulnerability exists in the core mapping engine. When a source object contains a property of the same type (or a type that eventually points back to itself), AutoMapper recursively attempts to map each level.

Because there is no default limit on how many levels deep this recursion can go, a sufficiently nested object (approximately 25,000+ levels in standard .NET environments) will exceed the stack size. Since StackOverflowException cannot be caught in modern .NET runtimes, the application cannot recover and will crash immediately.

Impact

• Availability: An attacker can crash the application server, leading to a complete Denial of Service.
• Process Termination: Unlike standard exceptions, this terminates the entire process, not just the individual request thread.

Proof of Concept (PoC)

The following C# code demonstrates the crash by creating a nested "Circular" object graph and attempting to map it:

class Circular { public Circular Self { get; set; } }

// Setup configuration
var config = new MapperConfiguration(cfg => {
    cfg.CreateMap<Circular, Circular>();
});
var mapper = config.CreateMapper();

// Create a deeply nested object (28,000+ levels)
var root = new Circular();
var current = root;
for (int i = 0; i < 30000; i++) {
    current.Self = new Circular();
    current = current.Self;
}

// This call triggers the StackOverflowException and crashes the process
mapper.Map<Circular>(root);

Recommended Mitigation

1. Secure Defaults: Implement a default MaxDepth (e.g., 32 or 64) for all mapping operations.
2. Configurable Limit: Allow users to increase this limit if necessary, but ensure it is enabled by default to protect unsuspecting developers.

Severity

• CVSS Score: 7.5 / 10 (High)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

• https://github.com/LuckyPennySoftware/AutoMapper/security/advisories/GHSA-rvv3-g6hj-g44x
• https://github.com/LuckyPennySoftware/AutoMapper/commit/0afaf1e91648fca1a57512e94dd00a76ee016816
• https://github.com/LuckyPennySoftware/AutoMapper/releases/tag/v16.1.1
• https://github.com/LuckyPennySoftware/AutoMapper/releases/tag/v15.1.1
• https://nvd.nist.gov/vuln/detail/CVE-2026-32933
• https://github.com/LuckyPennySoftware/AutoMapper/discussions/4624
• https://github.com/advisories/GHSA-rvv3-g6hj-g44x

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

LuckyPennySoftware/AutoMapper (AutoMapper)

v16.1.1

What's Changed

• Better async handling of license validation; fixes #​4612 by @​jbogard in #​4613
• More artifacts for builds (test results and SBOM) by @​jbogard in #​4615
• Update Microsoft.Sbom.DotNetTool to 4.1.5 by @​jbogard in #​4616

Security

Fixed an issue where certain cyclic or self-referential object graphs could trigger uncontrolled recursion during mapping, potentially resulting in stack exhaustion and denial of service.

Applications that process untrusted or attacker-controlled object graphs through affected mapping paths may be impacted.

Users should upgrade to this release.

Security advisory: GHSA-rvv3-g6hj-g44x

Thanks to @​skdishansachin for responsibly disclosing this issue.

Full Changelog: LuckyPennySoftware/AutoMapper@v16.1.0...v16.1.1

v16.1.0

What's Changed

• Add Debug and Release build configurations to slnx by @​Copilot in #​4590
• Migrating to slnx by @​jbogard in #​4589
• Allow disabling of polymorphic LINQ mapping by @​jbogard in #​4596
• Fix duplicate BOM in ServiceCollectionExtensions.cs by @​Copilot in #​4600
• Fix review feedback: double semicolon, DI condition integration test, docs example by @​Copilot in #​4601
• Adding DI-enabled conditions and pre-conditions; updated docs accordi… by @​jbogard in #​4599
• Adding support for DI-enabled destination factories. by @​jbogard in #​4603
• Correctly converting nullables for MapAtRuntime; fixes #​4597 by @​jbogard in #​4604
• Correctly handling consecutive uppercase characters; fixes #​4593 by @​jbogard in #​4605
• Wrapping the exception to provide better feedback to the user; fixes … by @​jbogard in #​4606
• Fixing bug around order of open generic registration by @​jbogard in #​4607
• Adding perpetual licensing by @​jbogard in #​4608

New Contributors

• @​Copilot made their first contribution in #​4590

Full Changelog: LuckyPennySoftware/AutoMapper@v16.0.0...v16.1.0

v16.0.0

What's Changed

• Fix release pipelines by @​jbogard in #​4583
• Adding support for .NET 10 by @​jbogard in #​4586

Full Changelog: LuckyPennySoftware/AutoMapper@v15.1.0...v16.0.0

v15.1.3

What's Changed

• Fix GHSA-rvv3-g6hj-g44x: default MaxDepth of 64 for self-referential types (15.x backport) by @​jbogard in #​4619

Security

Fixed an issue where certain cyclic or self-referential object graphs could trigger uncontrolled recursion during mapping, potentially resulting in stack exhaustion and denial of service.

Applications that process untrusted or attacker-controlled object graphs through affected mapping paths may be impacted.

Users should upgrade to this release.

Security advisory: GHSA-rvv3-g6hj-g44x

Thanks to @​skdishansachin for responsibly disclosing this issue.

Full Changelog: LuckyPennySoftware/AutoMapper@v15.1.0...v15.1.3

v15.1.2

What's Changed

• docs: Document duplicate license message behavior and fixes by @​Copilot in #​4617

Security

Fixed an issue where certain cyclic or self-referential object graphs could trigger uncontrolled recursion during mapping, potentially resulting in stack exhaustion and denial of service.

Applications that process untrusted or attacker-controlled object graphs through affected mapping paths may be impacted.

Users should upgrade to this release.

Security advisory: GHSA-rvv3-g6hj-g44x

Thanks to @​skdishansachin for responsibly disclosing this issue.

Full Changelog: LuckyPennySoftware/AutoMapper@v16.1.1...v15.1.2

v15.1.1

What's Changed

• docs: Document duplicate license message behavior and fixes by @​Copilot in #​4617

Security

Fixed an issue where certain cyclic or self-referential object graphs could trigger uncontrolled recursion during mapping, potentially resulting in stack exhaustion and denial of service.

Applications that process untrusted or attacker-controlled object graphs through affected mapping paths may be impacted.

Users should upgrade to this release.

Security advisory: GHSA-rvv3-g6hj-g44x

Thanks to @​skdishansachin for responsibly disclosing this issue.

Full Changelog: LuckyPennySoftware/AutoMapper@v16.1.1...v15.1.1

v15.1.0

What's Changed

• remove Microsoft.SourceLink.GitHub by @​SimonCropp in #​4555
• Direct .NET 4.x support by @​jbogard in #​4569
• Bumping the JsonWebTokens because of GHSA-8g4q-xg66-9fp4; fixes #​4575 by @​jbogard in #​4576
• Provide better exceptions for errors when building the mapping plan by @​jbogard in #​4577
• Adding docs for license configuration by @​jbogard in #​4581
• Updating refs to fix missing method issue by @​jbogard in #​4582

New Contributors

• @​SimonCropp made their first contribution in #​4555

Full Changelog: LuckyPennySoftware/AutoMapper@v15.0.1...v15.1.0

v15.0.1

What's Changed

• Removing public signing; fixes #​4545 by @​jbogard in #​4552
• Adding back missing overloads and reverting registering behavior by @​jbogard in #​4554

Full Changelog: LuckyPennySoftware/AutoMapper@v15.0.0...v15.0.1

This release supersedes the 15.0.0 release, reverting behavior and overloads so that the AddAutoMapper overloads separate the "scanning for maps" from the "scanning for dependencies". Unfortunately it's not really possible to combine these two together.

This also fixes a critical bug in #​4545 that does not work with .NET 4.x applications (as intended).

Because of this, the 15.0.0 will be delisted because of the breaking changes there.

v15.0.0

Full Changelog: LuckyPennySoftware/AutoMapper@v14.0.0...v15.0.0

• Added support for .NET Standard 2.0
• Requiring license key
• Moving from MIT license to dual commercial/OSS license

To set your license key:

services.AddAutoMapper(cfg => {
    cfg.LicenseKey = "<License key here>";
});

This also introduced a breaking change with MapperConfiguration requiring an ILoggerFactory for logging purposes:

public MapperConfiguration(MapperConfigurationExpression configurationExpression, ILoggerFactory loggerFactory)

Registering AutoMapper with services.AddAutoMapper will automatically supply this parameter. Otherwise you'll need to supply the logger factory.

You can obtain your license key at AutoMapper.io

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • ""
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.