CVE-2026-54638

Summary

gotd/td is a T Telegram MTProto API client in Go. Prior to 0.145.1, proto.UnencryptedMessage.Decode in proto/unencrypted_message.go read attacker controlled dataLen from an unauthenticated MTProto unencrypted packet and allocated make([]byte, dataLen) before checking the remaining buffer, allowing remote unauthenticated denial of service through excessive memory allocation and CPU or garbage collection pressure. This issue is fixed in version 0.145.1.

Affected Software

VendorProductVersion RangeStatus
gotdtd< 0.145.1affected

Weaknesses

  • CWE-770: CWE-770: Allocation of Resources Without Limits or Throttling
  • CWE-789: CWE-789: Memory Allocation with Excessive Size Value

References