Every CVESearch/Get API key

GHSA-8fh9-c4jq-94h4

idunno.Bluesky, idunno.AtProto and idunno.AtProto.OAuthCallback Denial of Service Vulnerability

7.5 HighFix available

GHSA-8fh9-c4jq-94h4 is a high vulnerability (CVSS 7.5) in idunno.AtProto, published March 13, 2026. No source lists public exploit code. Fixed in idunno.AtProto 1.7.0.

Severity
7.5 HighCVSS 3.1, GitHub Advisories
Exploit chance
UnscoredNo EPSS score yet
Exploitation
None knownNot on CISA’s or ENISA’s lists
Fixed in
1.7.0idunno.AtProto +5 more

Description

idunno.Bluesky, idunno.AtProto and idunno.AtProto.OAuthCallback Denial of Service Vulnerability

Impact

The Microsoft.Bcl.Memory package, a transitive dependency of idunno.AtProto and idunno.AtProto.OAuthCallback had a Denial of Service security vulnerability, CVE-2026-26127

Patches

v1.7.0 updates the dependencies on Duende.IdentityModel.OidcClient and Duende.IdentityModel.OidcClient.Extensions which, in turn, updates their dependency on Microsoft.Bcl.Memory to 10.0.4, resolving the vulnerability.

Workarounds

No workarounds exist for this vulnerability.

How to fix the issue

To update your dependencies on idunno.Bluesky, idunno.AtProto and idunno.AtProto.OAuthCallback,

Using the .NET CLI (Command Line Interface):

  • Open a terminal or command prompt in your project's directory.

  • To update a specific package to its latest version, use the following add package command:

    • If you are using idunno.Bluesky dotnet package update idunno.Bluesky

    • If you are using idunno.AtProto as a direct dependency dotnet package update idunno.AtProto

    • If you are using idunno.AtProto.OAuthCallback as a direct dependency dotnet package update idunno.AtProto.OAuthCallback

Using the NuGet Package Manager Console in Visual Studio:

  • Open your project in Visual Studio.

  • Navigate to "Tools > NuGet Package Manager > Package Manager Console".

  • To update a specific package to its latest version, use the following Update-Package command:

    • If you are using idunno.Bluesky Update-Package -Id idunno.Bluesky

    • If you are using idunno.AtProto as a direct dependency Update-Package -Id idunno.AtProto

    • If you are using idunno.AtProto.OAuthCallback as a direct dependency Update-Package -Id idunno.AtProto.OAuthCallback

NuGet Package Manager UI in Visual Studio:

  • Open your project in Visual Studio.
  • Right-click on your project in Solution Explorer and select "Manage NuGet Packages..." or navigate to "Project > Manage NuGet Packages".
  • In the NuGet Package Manager window, select the "Updates" tab. This tab lists packages with available updates from your configured package sources.
  • Select the package(s) you wish to update. You can choose a specific version from the dropdown or update to the latest available version.
  • Click the "Update" button.

References

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
High

Affected packages

Affected packages
PackageAffectedFixed
idunno.AtProto
NuGet
before 1.7.0
1.7.0
idunno.AtProto.OAuthCallback
NuGet
before 1.7.0
1.7.0
idunno.Bluesky
NuGet
before 1.7.0
1.7.0
idunno.AtProto
NuGet
before 1.7.0, plus listed versions
0.1.0-prerelease0.1.1-prerelease0.1.2-prerelease0.1.3-prerelease0.2.0-prerelease
Show 26 moreShow less
0.2.1-prerelease0.3.0-prerelease0.4.0-prerelease0.4.1-prerelease0.5.0-prerelease0.6.0-prerelease0.6.1-prerelease0.7.0-prerelease0.8.0-prerelease0.9.0-prerelease0.9.1-prerelease0.9.2-prerelease0.9.3-prerelease0.9.4-prerelease0.9.5-prerelease0.9.7-prerelease0.9.8-prerelease0.9.9-prerelease1.0.01.1.01.1.0-prerelease1.2.01.3.01.4.01.5.01.6.0
1.7.0
idunno.AtProto.OAuthCallback
NuGet
before 1.7.0, plus listed versions
0.3.0-prerelease0.4.0-prerelease0.4.1-prerelease0.5.0-prerelease0.6.0-prerelease
Show 20 moreShow less
0.6.1-prerelease0.7.0-prerelease0.8.0-prerelease0.9.0-prerelease0.9.1-prerelease0.9.2-prerelease0.9.3-prerelease0.9.4-prerelease0.9.5-prerelease0.9.7-prerelease0.9.8-prerelease0.9.9-prerelease1.0.01.1.01.1.0-prerelease1.2.01.3.01.4.01.5.01.6.0
1.7.0
idunno.Bluesky
NuGet
before 1.7.0, plus listed versions
0.1.0-prerelease0.1.1-prerelease0.1.2-prerelease0.1.3-prerelease0.2.0-prerelease
Show 26 moreShow less
0.2.1-prerelease0.3.0-prerelease0.4.0-prerelease0.4.1-prerelease0.5.0-prerelease0.6.0-prerelease0.6.1-prerelease0.7.0-prerelease0.8.0-prerelease0.9.0-prerelease0.9.1-prerelease0.9.2-prerelease0.9.3-prerelease0.9.4-prerelease0.9.5-prerelease0.9.7-prerelease0.9.8-prerelease0.9.9-prerelease1.0.01.1.01.1.0-prerelease1.2.01.3.01.4.01.5.01.6.0
1.7.0

What each source reports

GitHub Advisories Score used7.5

idunno.Bluesky, idunno.AtProto and idunno.AtProto.OAuthCallback Denial of Service Vulnerability

idunno.Bluesky, idunno.AtProto and idunno.AtProto.OAuthCallback Denial of Service Vulnerability

Impact

The Microsoft.Bcl.Memory package, a transitive dependency of idunno.AtProto and idunno.AtProto.OAuthCallback had a Denial of Service security vulnerability, CVE-2026-26127

Patches

v1.7.0 updates the dependencies on Duende.IdentityModel.OidcClient and Duende.IdentityModel.OidcClient.Extensions which, in turn, updates their dependency on Microsoft.Bcl.Memory to 10.0.4, resolving the vulnerability.

Workarounds

No workarounds exist for this vulnerability.

How to fix the issue

To update your dependencies on idunno.Bluesky, idunno.AtProto and idunno.AtProto.OAuthCallback,

Using the .NET CLI (Command Line Interface):

  • Open a terminal or command prompt in your project's directory.

  • To update a specific package to its latest version, use the following add package command:

    • If you are using idunno.Bluesky dotnet package update idunno.Bluesky

    • If you are using idunno.AtProto as a direct dependency dotnet package update idunno.AtProto

    • If you are using idunno.AtProto.OAuthCallback as a direct dependency dotnet package update idunno.AtProto.OAuthCallback

Using the NuGet Package Manager Console in Visual Studio:

  • Open your project in Visual Studio.

  • Navigate to "Tools > NuGet Package Manager > Package Manager Console".

  • To update a specific package to its latest version, use the following Update-Package command:

    • If you are using idunno.Bluesky Update-Package -Id idunno.Bluesky

    • If you are using idunno.AtProto as a direct dependency Update-Package -Id idunno.AtProto

    • If you are using idunno.AtProto.OAuthCallback as a direct dependency Update-Package -Id idunno.AtProto.OAuthCallback

NuGet Package Manager UI in Visual Studio:

  • Open your project in Visual Studio.
  • Right-click on your project in Solution Explorer and select "Manage NuGet Packages..." or navigate to "Project > Manage NuGet Packages".
  • In the NuGet Package Manager window, select the "Updates" tab. This tab lists packages with available updates from your configured package sources.
  • Select the package(s) you wish to update. You can choose a specific version from the dropdown or update to the latest available version.
  • Click the "Update" button.

References

Record
GHSA-8fh9-c4jq-94h4
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-129
Updated
2026-11-02
OSV7.5

idunno.Bluesky, idunno.AtProto and idunno.AtProto.OAuthCallback Denial of Service Vulnerability

idunno.Bluesky, idunno.AtProto and idunno.AtProto.OAuthCallback Denial of Service Vulnerability

Impact

The Microsoft.Bcl.Memory package, a transitive dependency of idunno.AtProto and idunno.AtProto.OAuthCallback had a Denial of Service security vulnerability, CVE-2026-26127

Patches

v1.7.0 updates the dependencies on Duende.IdentityModel.OidcClient and Duende.IdentityModel.OidcClient.Extensions which, in turn, updates their dependency on Microsoft.Bcl.Memory to 10.0.4, resolving the vulnerability.

Workarounds

No workarounds exist for this vulnerability.

How to fix the issue

To update your dependencies on idunno.Bluesky, idunno.AtProto and idunno.AtProto.OAuthCallback,

Using the .NET CLI (Command Line Interface):

  • Open a terminal or command prompt in your project's directory.

  • To update a specific package to its latest version, use the following add package command:

    • If you are using idunno.Bluesky dotnet package update idunno.Bluesky

    • If you are using idunno.AtProto as a direct dependency dotnet package update idunno.AtProto

    • If you are using idunno.AtProto.OAuthCallback as a direct dependency dotnet package update idunno.AtProto.OAuthCallback

Using the NuGet Package Manager Console in Visual Studio:

  • Open your project in Visual Studio.

  • Navigate to "Tools > NuGet Package Manager > Package Manager Console".

  • To update a specific package to its latest version, use the following Update-Package command:

    • If you are using idunno.Bluesky Update-Package -Id idunno.Bluesky

    • If you are using idunno.AtProto as a direct dependency Update-Package -Id idunno.AtProto

    • If you are using idunno.AtProto.OAuthCallback as a direct dependency Update-Package -Id idunno.AtProto.OAuthCallback

NuGet Package Manager UI in Visual Studio:

  • Open your project in Visual Studio.
  • Right-click on your project in Solution Explorer and select "Manage NuGet Packages..." or navigate to "Project > Manage NuGet Packages".
  • In the NuGet Package Manager window, select the "Updates" tab. This tab lists packages with available updates from your configured package sources.
  • Select the package(s) you wish to update. You can choose a specific version from the dropdown or update to the latest available version.
  • Click the "Update" button.

References

Record
GHSA-8fh9-c4jq-94h4
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-129
Updated
2026-11-02

History

History
RecordedChangedSources
first indexedGitHub Advisories, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

References

PagesAll vulnerabilitiesBrowseDocsSourcesGuideGet API key
MoveEnter Open