AutoMapper 16.3.0 and 15.1.4 Close MaxDepth Gaps Behind DoS Bugs
Jimmy Bogard shipped AutoMapper 16.3.0 and 15.1.4, both fixing two security issues, so anyone on 16.x or 15.x should upgrade. The default MaxDepth limit added in March turned out to be bypassable through constructor-built destinations and several other recursion paths, letting deeply nested self-referential graphs crash the process with an uncatchable StackOverflowException.
Key points
- Upgrade if you are on any 16.x or 15.x version; both releases patch two security issues
- The March MaxDepth default of 64 was not enforced on every mapping path
- Constructor-built destinations such as positional records ignored MaxDepth entirely
- Derived maps now inherit MaxDepth, and unbounded recursion throws a catchable InsufficientExecutionStackException
- Set MaxDepth explicitly if your polymorphic graphs legitimately go deeper than 64 levels
- 16.3.0 also adds a 30-day license renewal grace period that logs a warning instead of an error
Version 16.1.1 in March added a default MaxDepth of 64 to self-referential maps to stop deeply nested object graphs from exhausting the stack. It turned out several mapping paths never enforced that limit: when the destination is built through its constructor, as with positional records, MaxDepth was ignored outright (GHSA-6vhm-j9h7-f9gh). Derived maps using Include/IncludeBase did not inherit the limit, members typed as object or an interface skipped the default, and Dictionary<string, object> and ExpandoObject sources were not depth-tracked at all (GHSA-gpwp-5797-mjff).
The fix makes derived maps inherit MaxDepth and turns recursion the limit cannot bound into a catchable InsufficientExecutionStackException rather than a process-killing StackOverflowException. That is a behavior change, and polymorphic graphs legitimately deeper than 64 levels now need an explicit MaxDepth. 16.3.0 also brings Context.Items fixes, license key validation changes and updated ForAllMembers condition semantics.
Real-world use
- A public API that maps user-supplied JSON through AutoMapper and must not be taken down by deeply nested payloads
- Background workers mapping self-referential structures such as category trees or comment threads
- Multi-tenant services that build polymorphic maps with Include/IncludeBase and need bounded recursion depth
- Maintenance teams patching older 15.x applications after a security scan
Why it matters
Applications mapping untrusted, deeply nested input through these paths could lose the whole process to an exception you cannot catch; the new releases reduce that to a catchable error, at the cost of a small behavior change.