PT-2026-65618 · Gotd/Td · Gotd/Td

CVE-2026-54638 · Published 2026-07-28 · Updated 2026-07-28

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions gotd/td versions prior to 0.145.1

Description A remote unauthenticated attacker can cause a denial of service by sending a crafted unencrypted MTProto packet. The Decode() function in proto.UnencryptedMessage reads an attacker-controlled 32-bit dataLen field and allocates a buffer of that size using make([]byte, dataLen) before validating if the underlying buffer contains the declared number of bytes. This allows an attacker to force excessive memory allocation, leading to CPU and garbage collection pressure or Out-of-Memory (OOM) termination. This issue occurs during the unauthenticated MTProto handshake path, requiring no credentials or established session.

Recommendations Update to version 0.145.1 or later. Avoid exposing the unauthenticated MTProto parsing path to untrusted peers.

Fix

Allocation of Resources Without Limits

Weakness Enumeration

CWE-770

CWE-789

Related Identifiers

CVE-2026-54638

GHSA-WHMM-QJ9R-WVR2

Affected Products

Gotd/Td

References · 7

• https://osv.dev/vulnerability/GHSA-whmm-qj9r-wvr2 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-54638 · Security Note
• https://github.com/gotd/td/issues/1711 · Note
• https://github.com/gotd/td/releases/tag/v0.145.1 · Note
• https://github.com/gotd/td/commit/9d5d1f31ea5022d9798d84ccce15de2e91ba6baa · Note
• https://github.com/gotd/td/security/advisories/GHSA-whmm-qj9r-wvr2 · Note
• https://github.com/gotd/td · Note