A critical vulnerability in LuckyPennySoftware AutoMapper allows unauthenticated remote attackers to cause a denial of service by exhausting application stack memory.

The library suffers from uncontrolled recursion (CWE-674) when processing deeply nested object graphs. An unauthenticated attacker can supply a malicious object graph that bypasses depth limits, resulting in a StackOverflowException that terminates the host process.

The exploitation of this flaw leads to the immediate termination of the application process, resulting in a denial of service for all users. Given the CVSS score of 7.5, this high severity risk poses a significant threat to service availability and business continuity. Organizations relying on AutoMapper for data transformation may face operational downtime if this vulnerability is leveraged against public facing services.

Immediate Action: Update the AutoMapper package to version 16.1.1 or 15.1.1 immediately to implement the required depth limits for recursive calls.

Proactive Monitoring: Monitor application logs for unexpected process terminations or frequent StackOverflowException errors that may indicate exploitation attempts.

Compensating Controls: Deploy a Web Application Firewall to inspect incoming payloads for excessively nested JSON or object structures that could trigger the recursion flaw.

Public Exploit Available: Unknown

The risk of service disruption is significant for any .NET application utilizing the affected versions of AutoMapper. Security teams should prioritize the deployment of the patched versions, 16.1.1 or 15.1.1, to eliminate the recursion flaw. Failure to remediate could allow unauthenticated actors to reliably crash critical business services.