Cloudanix VulnDB

GHSA-f5v8-v6q3-q4h6

High · 7.5

Meridian: Multiple defense-in-depth gaps (collection/depth caps, telemetry, retry, fan-out)

CVSS

7.5

EPSS

—

Published

Apr 16, 2026

CISA due date

—

The record

Meridian v2.1.0 (`Meridian.Mapping` and `Meridian.Mediator`) shipped with nine defense-in-depth gaps reachable through its public APIs. Two are HIGH severity — the advertised `DefaultMaxCollectionItems` and `DefaultMaxDepth` safety caps are silently bypassed on the `IMapper.Map(source, destination)` overload and anywhere `.UseDestinationValue()` is configured on a collection-typed property. Four are MEDIUM (constructor invariant bypass, OpenTelemetry stack-trace info disclosure, retry amplification, notification fan-out amplification). Three are LOW (exception message disclosure, dictionary duplicate-key echo, static mediator cache growth under closed-generic types). All nine are patched in **v2.1.1**. Upgrade is a drop-in NuGet bump; see the v2.1.1 CHANGELOG for the four behavioural changes (constructor selection, OTel default, publisher fan-out cap, retry caps).

Affected packages

Ecosystem Package Introduced Fixed

Related vulnerabilities