CVE-2026-54638

HIGH7.5

td has pre-auth denial of service via unbounded memory allocation in proto.UnencryptedMessage.Decode

Published Jul 28, 2026

Modified 3 weeks ago

Details

gotd/td is a T Telegram MTProto API client in Go. Prior to 0.145.1, proto.UnencryptedMessage.Decode in proto/unencrypted_message.go read attacker controlled dataLen from an unauthenticated MTProto unencrypted packet and allocated make([]byte, dataLen) before checking the remaining buffer, allowing remote unauthenticated denial of service through excessive memory allocation and CPU or garbage collection pressure. This issue is fixed in version 0.145.1.

References

WEB

https://github.com/gotd/td/commit/9d5d1f31ea5022d9798d84ccce15de2e91ba6baa

WEB

https://github.com/gotd/td/issues/1711

WEB

https://github.com/gotd/td/releases/tag/v0.145.1

WEB

https://github.com/gotd/td/security/advisories/GHSA-whmm-qj9r-wvr2

ADVISORY

https://www.cve.org/CVERecord?id=CVE-2026-54638

CVSS Analysis