CVE-2026-54638 Details
Description
gotd/td is a T Telegram MTProto API client in Go. Prior to 0.145.1, proto.UnencryptedMessage.Decode in proto/unencrypted_message.go read attacker controlled dataLen from an unauthenticated MTProto unencrypted packet and allocated make([]byte, dataLen) before checking the remaining buffer, allowing remote unauthenticated denial of service through excessive memory allocation and CPU or garbage collection pressure. This issue is fixed in version 0.145.1.
A denial-of-service vulnerability has been identified in the gotd td Telegram MTProto API client, affecting versions prior to 0.145.1. The issue arises in the UnencryptedMessage.Decode method, where the function reads an attacker-controlled length value from an unauthenticated MTProto packet. This leads to excessive memory allocation and increased CPU or garbage collection pressure, causing potential degradation of process availability. The vulnerability can be exploited by sending a crafted packet that tricks the application into allocating large amounts of memory before validating the input, effectively exhausting resources and causing the application to slow down or crash.
Users can upgrade to version 0.145.1 or later, where this vulnerability has been fixed by adding proper validation of the data length before allocation. Instructions for downloading the latest version are available on the project's GitHub releases page.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 28, 2026CISA-ADP
Assessed Jul 29, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/gotd/td/commit/9d5d1f31ea5022d9798d84ccce15de2e91ba6baa | [email protected] | Source CodeVendor |
| https://github.com/gotd/td/issues/1711 | [email protected] | ExploitIssue TrackingTechnical AnalysisVendor |
| https://github.com/gotd/td/releases/tag/v0.145.1 | [email protected] | Release NotesVendor |
| https://github.com/gotd/td/security/advisories/GHSA-whmm-qj9r-wvr2 | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-770 | Allocation of Resources Without Limits or Throttling | [email protected] |
| CWE-789 | Memory Allocation with Excessive Size Value | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| gotd/td | < 0.145.1 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 29, 2026 | CVE Modified | CISA-ADP |
| Jul 28, 2026 | New CVE Received | [email protected] |