{"id":"CVE-2026-54638","title":"gotd/td is a T Telegram MTProto API client in Go","summary":"gotd/td is a T Telegram MTProto API client in Go. Prior to 0.145.1, proto.UnencryptedMessage.Decode in proto/unencrypted_message.go read attacker controlled dataLen from an unauthenticated MTProto unencrypted packet and allocated make([]…","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cwe":["CWE-770","CWE-789"],"vendor":"gotd","product":"github.com/gotd/td","affected":["github.com/gotd/td < 0.145.1"],"patched":["github.com/gotd/td 0.145.1"],"published":"2026-07-28","updated":"2026-09-10","sourceUpdated":"2026-09-10T20:05:05.293","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-54638","references":[{"url":"https://github.com/gotd/td/commit/9d5d1f31ea5022d9798d84ccce15de2e91ba6baa","label":"security-advisories@github.com"},{"url":"https://github.com/gotd/td/issues/1711","label":"security-advisories@github.com"},{"url":"https://github.com/gotd/td/releases/tag/v0.145.1","label":"security-advisories@github.com"},{"url":"https://github.com/gotd/td/security/advisories/GHSA-whmm-qj9r-wvr2","label":"security-advisories@github.com"},{"url":"https://github.com/advisories/GHSA-whmm-qj9r-wvr2"}],"tags":["nvd","ghsa","go"],"epss":0.0063,"epssPercentile":0.47907,"aliases":["GHSA-whmm-qj9r-wvr2"],"ecosystem":"go","ingestedAt":"2026-07-28T22:40:03.235Z","slug":"CVE-2026-54638","body":"## Overview\n\ngotd/td is a T Telegram MTProto API client in Go. Prior to 0.145.1, proto.UnencryptedMessage.Decode in proto/unencrypted_message.go read attacker controlled dataLen from an unauthenticated MTProto unencrypted packet and allocated make([]byte, dataLen) before checking the remaining buffer, allowing remote unauthenticated denial of service through excessive memory allocation and CPU or garbage collection pressure. This issue is fixed in version 0.145.1.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Package advisory (CVE-2026-54638)\n\nAffected packages:\n\n- `github.com/gotd/td < 0.145.1`\n\nPatched in:\n\n- `github.com/gotd/td 0.145.1`\n\nSource: https://github.com/advisories/GHSA-whmm-qj9r-wvr2","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}