CVE-2026-54638

gotd/td is a T Telegram MTProto API client in Go. Prior to 0.145.1, proto.UnencryptedMessage.Decode in proto/unencrypted_message.go read attacker controlled dataLen from an unauthenticated MTProto unencrypted packet and allocated make([]byte, dataLen) before checking the remaining buffer, allowing remote unauthenticated denial of service through excessive memory allocation and CPU or garbage collection pressure. This issue is fixed in version 0.145.1.

CVSS 3.1

7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS

0.6% chance of exploitation in the next 30 days; higher than 49% of CVEs (scores of 2026-10-25)

CWEs

CWE-770, CWE-789

Published

2026-07-28

Modified

2026-10-23

Record from

the NVD, synced 2026-10-24

Packages (OSV)

References

• https://github.com/gotd/td/commit/9d5d1f31ea5022d9798d84ccce15de2e91ba6baa
• https://github.com/gotd/td/issues/1711
• https://github.com/gotd/td/releases/tag/v0.145.1
• https://github.com/gotd/td/security/advisories/GHSA-whmm-qj9r-wvr2

Check your stackJSON