GHSA-8fh9-c4jq-94h4: idunno.Bluesky, idunno.AtProto and idunno.AtProto.OAuthCallback Denial of Service Vulnerability

March 13, 2026

The Microsoft.Bcl.Memory package, a transitive dependency of idunno.AtProto and idunno.AtProto.OAuthCallback had a Denial of Service security vulnerability, CVE-2026-26127

References

github.com/advisories/GHSA-8fh9-c4jq-94h4
github.com/blowdart/idunno.Bluesky
github.com/blowdart/idunno.Bluesky/security/advisories/GHSA-8fh9-c4jq-94h4
github.com/dotnet/announcements/issues/384
www.cve.org/CVERecord?id=CVE-2026-26127

Code Behaviors & Features

Detect and mitigate GHSA-8fh9-c4jq-94h4 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →