Get every Dometrain 30% off with code HANDSON30: https://dometrain.com/courses/?ref=nick-chapsas&promo=youtube&coupon_code=HANDSON30

Hello, everybody. I'm Nick, and in this video, I will talk about the new AutoMapper High Severity vulnerability that can crash your .NET server due to uncontrollable recursion. But is it really as big of an issue as it is being presented? 

Don't forget to comment, like and subscribe :)

Social Media:
Follow me on GitHub: https://github.com/Elfocrash
Follow me on Twitter: https://twitter.com/nickchapsas
Connect on LinkedIn: https://www.linkedin.com/in/nick-chapsas

#csharp #dotnet

Nick Chapsas

AutoMapper has a reported vulnerability where deeply nested circular object mappings can trigger a StackOverflowException, crashing a .NET server since such exceptions cannot be caught at runtime. The author is skeptical of the severity rating (7.5/10), arguing it is a general recursion problem inherent to programming, not specific to AutoMapper. A workaround exists in older versions by setting MaxDepth on CreateMap calls, and JSON's own max depth validation typically prevents external exploitation. The author also suspects the vulnerability disclosure is commercially motivated to push users toward AutoMapper's paid licensing tiers, since only paid versions received the official patch. The recommendation is to avoid AutoMapper on new projects and use source-generated mappers instead.

How AutoMapper Can Crash Your .NET Server

<p>Troubleshooting these issues is also a nightmare. Once it happened, my confidence on the library was completely eroded</p>
