CVE-2026-54638

gotd/td is a T Telegram MTProto API client in Go. Prior to 0.145.1, proto.UnencryptedMessage.Decode in proto/unencrypted_message.go read attacker controlled dataLen from an unauthenticated MTProto unencrypted packet and allocated make([]byte, dataLen) before checking the remaining buffer, allowing remote unauthenticated denial of service through excessive memory allocation and CPU or garbage collection pressure. This issue is fixed in version 0.145.1.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/gotd/td/commit/9d5d1f31ea5022d9798d84ccce15de2e91ba6baa
https://github.com/gotd/td/issues/1711
https://github.com/gotd/td/releases/tag/v0.145.1
https://github.com/gotd/td/security/advisories/GHSA-whmm-qj9r-wvr2

Configurations

No configuration.

History

23 Oct 2026, 23:10

Type	Values Removed	Values Added
Summary		(es) gotd/td es un cliente API MTProto de Telegram T en Go. Antes de la versión 0.145.1, proto.UnencryptedMessage.Decode en proto/unencrypted_message.go leía un dataLen controlado por el atacante de un paquete MTProto no cifrado no autenticado y asignaba make([]byte, dataLen) antes de verificar el búfer restante, lo que permitía una denegación de servicio remota no autenticada a través de una asignación excesiva de memoria y presión de CPU o de recolección de basura. Este problema se solucionó en la versión 0.145.1.

Information

Published : 2026-07-28 23:17

Updated : 2026-10-23 23:10

NVD link : CVE-2026-54638

Mitre link : CVE-2026-54638

CVE.ORG link : CVE-2026-54638

JSON object : View

Products Affected

No product.

CWE

CWE-770

Allocation of Resources Without Limits or Throttling

CWE-789

Memory Allocation with Excessive Size Value

{"id": "CVE-2026-54638", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-54638", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-29T14:20:16.425469Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "gotd", "product": "td", "versions": [{"status": "affected", "version": "< 0.145.1"}]}]}], "published": "2026-07-28T23:17:08.617", "references": [{"url": "https://github.com/gotd/td/commit/9d5d1f31ea5022d9798d84ccce15de2e91ba6baa", "source": "security-advisories@github.com"}, {"url": "https://github.com/gotd/td/issues/1711", "source": "security-advisories@github.com"}, {"url": "https://github.com/gotd/td/releases/tag/v0.145.1", "source": "security-advisories@github.com"}, {"url": "https://github.com/gotd/td/security/advisories/GHSA-whmm-qj9r-wvr2", "source": "security-advisories@github.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-770"}, {"lang": "en", "value": "CWE-789"}]}], "descriptions": [{"lang": "en", "value": "gotd/td is a T Telegram MTProto API client in Go. Prior to 0.145.1, proto.UnencryptedMessage.Decode in proto/unencrypted_message.go read attacker controlled dataLen from an unauthenticated MTProto unencrypted packet and allocated make([]byte, dataLen) before checking the remaining buffer, allowing remote unauthenticated denial of service through excessive memory allocation and CPU or garbage collection pressure. This issue is fixed in version 0.145.1."}, {"lang": "es", "value": "gotd/td es un cliente API MTProto de Telegram T en Go. Antes de la versi\u00f3n 0.145.1, proto.UnencryptedMessage.Decode en proto/unencrypted_message.go le\u00eda un dataLen controlado por el atacante de un paquete MTProto no cifrado no autenticado y asignaba make([]byte, dataLen) antes de verificar el b\u00fafer restante, lo que permit\u00eda una denegaci\u00f3n de servicio remota no autenticada a trav\u00e9s de una asignaci\u00f3n excesiva de memoria y presi\u00f3n de CPU o de recolecci\u00f3n de basura. Este problema se solucion\u00f3 en la versi\u00f3n 0.145.1."}], "lastModified": "2026-10-23T23:10:00.157", "sourceIdentifier": "security-advisories@github.com"}