From 22504d19bd456c709c801cb6c3ad32c6d8196b27 Mon Sep 17 00:00:00 2001
From: mkarbowski-quilt <107502479+mkarbowski-quilt@users.noreply.github.com>
Date: Tue, 24 Mar 2026 11:34:26 -0400
Subject: [PATCH] Improve GHSA-rvv3-g6hj-g44x

---
 .../03/GHSA-rvv3-g6hj-g44x/GHSA-rvv3-g6hj-g44x.json   | 11 +++--------
 1 file changed, 3 insertions(+), 8 deletions(-)

diff --git a/advisories/github-reviewed/2026/03/GHSA-rvv3-g6hj-g44x/GHSA-rvv3-g6hj-g44x.json b/advisories/github-reviewed/2026/03/GHSA-rvv3-g6hj-g44x/GHSA-rvv3-g6hj-g44x.json
index 20ef6c3b67137..c501d08a9bbc1 100644
--- a/advisories/github-reviewed/2026/03/GHSA-rvv3-g6hj-g44x/GHSA-rvv3-g6hj-g44x.json
+++ b/advisories/github-reviewed/2026/03/GHSA-rvv3-g6hj-g44x/GHSA-rvv3-g6hj-g44x.json
@@ -1,19 +1,14 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-rvv3-g6hj-g44x",
-  "modified": "2026-03-20T21:20:05Z",
+  "modified": "2026-03-20T21:20:06Z",
   "published": "2026-03-13T20:57:07Z",
   "aliases": [
     "CVE-2026-32933"
   ],
   "summary": "AutoMapper Vulnerable to Denial of Service (DoS) via Uncontrolled Recursion",
   "details": "### Summary\n\nAutoMapper is vulnerable to a Denial of Service (DoS) attack. When mapping deeply nested object graphs, the library uses recursive method calls without enforcing a default maximum depth limit. This allows an attacker to provide a specially crafted object graph that exhausts the thread's stack memory, triggering a `StackOverflowException` and causing the entire application process to terminate.\n\n### Description\n\nThe vulnerability exists in the core mapping engine. When a source object contains a property of the same type (or a type that eventually points back to itself), AutoMapper recursively attempts to map each level.\n\nBecause there is no default limit on how many levels deep this recursion can go, a sufficiently nested object (approximately 25,000+ levels in standard .NET environments) will exceed the stack size. Since `StackOverflowException` cannot be caught in modern .NET runtimes, the application cannot recover and will crash immediately.\n\n### Impact\n\n* **Availability:** An attacker can crash the application server, leading to a complete Denial of Service.\n* **Process Termination:** Unlike standard exceptions, this terminates the entire process, not just the individual request thread.\n\n### Proof of Concept (PoC)\n\nThe following C# code demonstrates the crash by creating a nested \"Circular\" object graph and attempting to map it:\n\n```csharp\nclass Circular { public Circular Self { get; set; } }\n\n// Setup configuration\nvar config = new MapperConfiguration(cfg => {\n    cfg.CreateMap<Circular, Circular>();\n});\nvar mapper = config.CreateMapper();\n\n// Create a deeply nested object (28,000+ levels)\nvar root = new Circular();\nvar current = root;\nfor (int i = 0; i < 30000; i++) {\n    current.Self = new Circular();\n    current = current.Self;\n}\n\n// This call triggers the StackOverflowException and crashes the process\nmapper.Map<Circular>(root);\n\n```\n\n### Recommended Mitigation\n\n1. **Secure Defaults:** Implement a default `MaxDepth` (e.g., 32 or 64) for all mapping operations.\n2. **Configurable Limit:** Allow users to increase this limit if necessary, but ensure it is enabled by default to protect unsuspecting developers.",
-  "severity": [
-    {
-      "type": "CVSS_V3",
-      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
-    }
-  ],
+  "severity": [],
   "affected": [
     {
       "package": {
@@ -84,7 +79,7 @@
     "cwe_ids": [
       "CWE-674"
     ],
-    "severity": "HIGH",
+    "severity": "LOW",
     "github_reviewed": true,
     "github_reviewed_at": "2026-03-13T20:57:07Z",
     "nvd_published_at": "2026-03-20T03:16:00Z"