AutoMapper 14 Vulnerability (GHSA-rvv3-g6hj-g44x / CVE-2026-32933) - DoS via StackOverflowException in ABP Commercial #10542

2 Answer(s)

• 

  0

  AI-Bot created yesterday

  Support Team ABP Agent

  • ABP Commercial v10.0.1 guidance (practical + ABP-aligned):

    • In ABP v10, ABP has already moved its framework object-to-object mapping integration to Mapperly (so most ABP modules won’t be depending on AutoMapper anymore by default). If your solution still references AutoMapper 14.x, it’s typically coming from your application code (custom profiles/mappings), not from ABP modules.
    • Best immediate mitigation in an ABP v10.0.1 app: remove AutoMapper from the runtime path by migrating your app mappings to Mapperly and switching the ABP object mapper integration to Volo.Abp.Mapperly. This avoids relying on AutoMapper’s runtime recursion behavior entirely.

  • Temporary mitigation via “global MaxDepth in ABP AutoMapper setup”:

    • I could not find any verified ABP v10.x configuration surface in the available indexed sources that shows ABP exposing a global “AutoMapper MaxDepth” setting (e.g., via Configure<AbpAutoMapperOptions>(...) and an AutoMapper MaxDepth hook) that I can safely recommend here.
    • Because I can’t verify a correct ABP-specific knob for this, I’m not going to suggest an unverified configuration snippet.

  • Which ABP modules/services are affected?

    • Based on verified ABP context: ABP v10’s framework-level mapping uses Mapperly by default, and AutoMapper is optional/legacy for your solution code. So the most likely “affected area” is any of your endpoints/services that call AutoMapper directly (or any custom ABP layer where you explicitly added Volo.Abp.AutoMapper + AutoMapper profiles).
    • Practically: search your solution for Volo.Abp.AutoMapper, AddAutoMapperObjectMapper, and Profile : AutoMapper.Profile usage; those are your risk hotspots.

  • Official patch / security timeline request (Commercial-specific):

    • This is security + product support/timeline related. Please contact ABP/Volosoft via the official channel so they can provide an official statement and timeline: https://abp.io/contact

  • If you want the ABP-supported replacement path (works on ABP v10):

    1. Remove AutoMapper packages from your solution (where feasible) and add Volo.Abp.Mapperly.
    2. In your modules, depend on AbpMapperlyModule and register Mapperly object mapper:

  using Volo.Abp.Modularity;
       using Volo.Abp.Mapperly;
  
       [DependsOn(typeof(AbpMapperlyModule))]
       public class YourProjectApplicationModule : AbpModule
       {
           public override void ConfigureServices(ServiceConfigurationContext context)
           {
               context.Services.AddMapperlyObjectMapper<YourProjectApplicationModule>();
           }
       }
  

  3. Convert AutoMapper profiles to Mapperly mappers (ABP’s recommended direction in v10).

  (Links you provided: only https://nvd.nist.gov/vuln/detail/CVE-2026-32933 was reachable from my URL validator; the GitHub advisory/OSV links were not reachable at validation time, so I did not rely on them here.)

  ---

  This response was generated by AI. If it didn’t solve your problem, feel free to post a new answer — our support team will jump in to help you soon.

  Save Cancel
• 

  0

  maliming created yesterday

  Support Team Fullstack Developer

  hi

  We have added a code-level fix in Volo.Abp.AutoMapper module by setting MaxDepth = 64 for all maps that don't have an explicit MaxDepth configured. This mitigates the actual DoS vulnerability (GHSA-rvv3-g6hj-g44x) at the framework level. See #25138.

  However, since the NuGet security audit checks package versions rather than code, you will still see the NU1902/NU1903 warning as long as AutoMapper 14.0.0 is referenced. Unfortunately, the AutoMapper maintainer has confirmed that no patch will be released for version 14.x (see AutoMapper#4618). Only the commercial versions (15.x/16.x) have been patched.

  Workaround: To suppress the NuGet audit warning, add the following to your project file (.csproj) or Directory.Build.props:

  <ItemGroup>
    <NuGetAuditSuppress Include="https://github.com/advisories/GHSA-rvv3-g6hj-g44x" />
  </ItemGroup>
  

  Recommended long-term solution: We recommend migrating from AutoMapper to Mapperly. ABP Framework has built-in support for Mapperly, and we have been progressively migrating all modules to use it. See the migration guide for details.

  See https://github.com/abpframework/abp/issues/25137 https://github.com/abpframework/abp/pull/25138

  Thanks.

  Save Cancel