HIGH

CVE-2026-54638

2026-07-28 CVSS v3.1

CVSS

7.5

Description

gotd/td is a T Telegram MTProto API client in Go. Prior to 0.145.1, proto.UnencryptedMessage.Decode in proto/unencrypted_message.go read attacker controlled dataLen from an unauthenticated MTProto unencrypted packet and allocated make([]byte, dataLen) before checking the remaining buffer, allowing remote unauthenticated denial of service through excessive memory allocation and CPU or garbage collection pressure. This issue is fixed in version 0.145.1.

Weakness (CWE)

CWE-770 Resource Allocation Without Limits

CWE-789

EPSS Score

0.35%

Probability of exploitation in next 30 days

28.2th percentile

References

https://github.com/gotd/td/commit/9d5d1f31ea5022d9798d84ccce15de2e91ba6baa https://github.com/gotd/td/issues/1711 https://github.com/gotd/td/releases/tag/v0.145.1 https://github.com/gotd/td/security/advisories/GHSA-whmm-qj9r-wvr2

View on dbcve.org

Base CVE data derived from NVD (public domain). Enrichment by dbcve.org (CC-BY-4.0). Fetched via API.

Back to CVE