CVE-2026-54638
HIGH SEVERITYCVSS Score & Metrics
Base Score
7.5 / 10
Vulnerability Description
gotd/td is a T Telegram MTProto API client in Go. Prior to 0.145.1, proto.UnencryptedMessage.Decode in proto/unencrypted_message.go read attacker controlled dataLen from an unauthenticated MTProto unencrypted packet and allocated make([]byte, dataLen) before checking the remaining buffer, allowing remote unauthenticated denial of service through excessive memory allocation and CPU or garbage collection pressure. This issue is fixed in version 0.145.1.
Vulnerability Details
Published Date
Last Modified
Source
GitHub
Vendor
go
Product
github.com/gotd/td
Discussion (0)
Add Comment
No comments yet. Be the first!