CVE-2026-54638CWE-770CWE-789denial-of-service

CVE-2026-54638

High · published July 29, 2026

CVSS v3.1
7.5
EPSS
1%
Percentile
49.5
In the wild
Unconfirmed
What it is

gotd/td is a T Telegram MTProto API client in Go. Prior to 0.145.1, proto.UnencryptedMessage.Decode in proto/unencrypted_message.go read attacker controlled dataLen from an unauthenticated MTProto unencrypted packet and allocated make([]byte, dataLen) before checking the remaining buffer, allowing remote unauthenticated denial of service through excessive memory allocation and CPU or garbage collection pressure. This issue is fixed in version 0.145.1.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00630 · 49.5th percentile
Weaknesses
CWE-770 · Allocation of Resources Without Limits or Throttling; CWE-789 · Memory Allocation with Excessive Size Value
Published
2026-07-29T03:17Z
References (4)
https://github.com/gotd/td/commit/9d5d1f31ea5022d9798d84ccce15de2e91ba6baa · [email protected]https://github.com/gotd/td/issues/1711 · [email protected]https://github.com/gotd/td/releases/tag/v0.145.1 · [email protected]https://github.com/gotd/td/security/advisories/GHSA-whmm-qj9r-wvr2 · [email protected]
EPSS history
Timeline
  • 28 JUL 22:14Z
    td has pre-auth denial of service via unbounded memory allocation in proto.UnencryptedMessage.Decode
    cvelistv5