AutoMapper, a popular .NET object‑to‑object mapping library, uses recursive method calls when handling instance graphs. In versions prior to 15.1.1 and 16.1.1 no maximum depth is enforced, allowing an attacker to supply an object graph with arbitrarily deep nesting. The resulting deep recursion exhausts the thread stack, meaning a StackOverflowException is thrown and the application process terminates. The weakness is identified as CWE‑674: Uncontrolled Recursion.

LuckyPennySoftware’s AutoMapper library is affected. All releases before 15.1.1 and 16.1.1 contain the flaw; the problem was remedied in those two releases by adding a recursion depth limit.

The CVSS base score of 7.5 indicates a high severity, while the EPSS score of less than 1 % suggests that exploitation opportunities are currently rare. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires the attacker to supply the maliciously nested object graph, typically through API input or code injection that invokes AutoMapper. Once the stack is exhausted the application crashes, providing no opportunity for further malicious activity but resulting in a denial‑of‑service condition. The risk remains significant in environments where uptime is critical.