Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

NuGet package

idunno.atproto

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. High, CVSS 7.5NuGetPublished

    idunno.Bluesky, idunno.AtProto and idunno.AtProto.OAuthCallback Denial of Service Vulnerability

    GHSA-8fh9-c4jq-94h4

    Affected
    • NuGet idunno.atproto < 1.7.0
    Fixed in
    1.7.0· Vendor fix available
    Issue
    idunno.Bluesky, idunno.AtProto and idunno.AtProto.OAuthCallback Denial of Service Vulnerability Impact The Microsoft.Bcl.Memory package, a transitive dependency of idunno.AtProto and idunno.AtProto.OAuthCallback had a Denial of Service security vulnerability, CVE-2026-26127 Patches v1.7.0 updates the dependencies on Duende.IdentityModel.OidcClient and Duende.IdentityModel.OidcClient.Extensions which, in turn, updates their dependency on Microsoft.Bcl.Memory to 10.0.4, resolving the vulnerability. Workarounds No workarounds exist for this vulnerability. How to fix the issue To update your dependencies on idunno.Bluesky, idunno.AtProto and idunno.AtProto.OAuthCallback, Using the .NET CLI (Command Line Interface): Open a terminal or command prompt in your project's directory. To update a specific package to its latest version, use the following add package command: If you are using idunno.Bluesky dotnet package update idunno.Bluesky If you are using idunno.AtProto as a direct dependency…

    Recommended action: Upgrade to 1.7.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →