idunno.Bluesky, idunno.AtProto and idunno.AtProto.OAuthCallback Denial of Service Vulnerability
idunno.Bluesky, idunno.AtProto and idunno.AtProto.OAuthCallback Denial of Service Vulnerability
Impact
The Microsoft.Bcl.Memory package, a transitive dependency of idunno.AtProto and idunno.AtProto.OAuthCallback had a Denial of Service security vulnerability, CVE-2026-26127
Patches
v1.7.0 updates the dependencies on Duende.IdentityModel.OidcClient and Duende.IdentityModel.OidcClient.Extensions which, in turn, updates their dependency on Microsoft.Bcl.Memory to 10.0.4, resolving the vulnerability.
Workarounds
No workarounds exist for this vulnerability.
How to fix the issue
To update your dependencies on idunno.Bluesky, idunno.AtProto and idunno.AtProto.OAuthCallback,
Using the .NET CLI (Command Line Interface):
-
Open a terminal or command prompt in your project's directory.
-
To update a specific package to its latest version, use the following add package command:
-
If you are using
idunno.Blueskydotnet package update idunno.Bluesky -
If you are using
idunno.AtProtoas a direct dependencydotnet package update idunno.AtProto -
If you are using
idunno.AtProto.OAuthCallbackas a direct dependencydotnet package update idunno.AtProto.OAuthCallback
-
Using the NuGet Package Manager Console in Visual Studio:
-
Open your project in Visual Studio.
-
Navigate to "Tools > NuGet Package Manager > Package Manager Console".
-
To update a specific package to its latest version, use the following Update-Package command:
-
If you are using
idunno.BlueskyUpdate-Package -Id idunno.Bluesky -
If you are using
idunno.AtProtoas a direct dependencyUpdate-Package -Id idunno.AtProto -
If you are using
idunno.AtProto.OAuthCallbackas a direct dependencyUpdate-Package -Id idunno.AtProto.OAuthCallback
-
NuGet Package Manager UI in Visual Studio:
- Open your project in Visual Studio.
- Right-click on your project in Solution Explorer and select "Manage NuGet Packages..." or navigate to "Project > Manage NuGet Packages".
- In the NuGet Package Manager window, select the "Updates" tab. This tab lists packages with available updates from your configured package sources.
- Select the package(s) you wish to update. You can choose a specific version from the dropdown or update to the latest available version.
- Click the "Update" button.
References
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| .NET (NuGet) | idunno.AtProto | < 1.7.0 | 1.7.0 |
| .NET (NuGet) | idunno.AtProto.OAuthCallback | < 1.7.0 | 1.7.0 |
| .NET (NuGet) | idunno.Bluesky | < 1.7.0 | 1.7.0 |
References
- CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H- Weakness (CWE)
CWE-129- Platform
- .NET (NuGet)
- Package
idunno.AtProto, idunno.AtProto.OAuthCallback, idunno.Bluesky- Disclosed
- 13.03.2026
- Updated
- 11.10.2026 11:23
Sources and licenses
OSV / GitHub Advisory Database - GHSA-8fh9-c4jq-94h4 - CC BY 4.0
Vulnerability history: idunno.AtProto
All published vulnerabilities of this package (.NET (NuGet)), newest first. Shows whether this is a one-off slip or a package that needs watching.
This is the only known vulnerability of this package.
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.