AutoMapper versions prior to 16.3.0 and before 15.1.4 contain a denial of service vulnerability due to uncontrolled recursion that bypasses the MaxDepth limit. This flaw affects polymorphic maps, runtime-typed members, dictionary and dynamic sources, and recursive type converters, allowing deeply nested attacker-controlled data to cause a StackOverflowException and crash the application. The issue is fixed in versions 16.3.0 and 15.1.4.