CVE-2026-54638

Received Received - Intake

Heap Overflow in gotd/td Go Library

Publication date: 2026-07-28

Last updated on: 2026-07-28

Assigner: GitHub, Inc.

Description

gotd/td is a T Telegram MTProto API client in Go. Prior to 0.145.1, proto.UnencryptedMessage.Decode in proto/unencrypted_message.go read attacker controlled dataLen from an unauthenticated MTProto unencrypted packet and allocated make([]byte, dataLen) before checking the remaining buffer, allowing remote unauthenticated denial of service through excessive memory allocation and CPU or garbage collection pressure. This issue is fixed in version 0.145.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-28

Last Modified

2026-07-28

Generated

2026-07-29

AI Q&A

2026-07-29

EPSS Evaluated

N/A

NVD

CVE-2026-54638

Affected Vendors & Products

Vendor	Product	Version / Range
gotd	td	to 0.145.1 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-789	The product allocates memory based on an untrusted, large size value, but it does not ensure that the size is within expected limits, allowing arbitrary amounts of memory to be allocated.
CWE-770	The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

Attack-Flow Graph

Executive Summary

This is a denial of service vulnerability in gotd/td, a Telegram MTProto API client in Go. It occurs when proto.UnencryptedMessage.Decode reads an attacker-controlled data length from an unauthenticated unencrypted packet and allocates excessive memory before verifying the remaining buffer size. This causes high memory usage, CPU load, or garbage collection pressure, leading to a remote denial of service.

Detection Guidance

This vulnerability can be detected by checking the version of gotd/td in use. If the version is below 0.145.1, the system is vulnerable. No specific commands are provided in the context to detect exploitation attempts.

Impact Analysis

If exploited, this vulnerability can cause your application to consume excessive memory and CPU resources, leading to crashes, slowdowns, or unavailability. It affects systems using vulnerable versions of gotd/td to handle unauthenticated Telegram MTProto unencrypted packets.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards as it pertains to a denial of service issue in a software library rather than data privacy or security controls. However, denial of service conditions could indirectly impact service availability, which may affect compliance with availability requirements in some regulatory frameworks.

Mitigation Strategies

Update gotd/td to version 0.145.1 or later to address the vulnerability. Monitor network traffic for unauthenticated MTProto unencrypted packets that may trigger excessive memory allocation or CPU usage.

Hi! I’m here to help you understand CVE-2026-54638. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70