CVE-2026-54638 in gotd
Summary
by MITRE • 07/29/2026
gotd/td is a T Telegram MTProto API client in Go. Prior to 0.145.1, proto.UnencryptedMessage.Decode in proto/unencrypted_message.go read attacker controlled dataLen from an unauthenticated MTProto unencrypted packet and allocated make([]byte, dataLen) before checking the remaining buffer, allowing remote unauthenticated denial of service through excessive memory allocation and CPU or garbage collection pressure. This issue is fixed in version 0.145.1.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 07/29/2026
The vulnerability exists within the gotd/td Telegram MTProto API client implementation in Go, specifically in the proto.UnencryptedMessage.Decode function located in proto/unencrypted_message.go. This flaw represents a classic buffer overflow condition where attacker-controlled data length values are processed without proper validation against available buffer boundaries. The issue stems from the client's failure to validate the dataLen parameter extracted from unauthenticated MTProto packets before proceeding with memory allocation operations.
The technical implementation of this vulnerability allows remote attackers to craft malicious MTProto unencrypted packets containing arbitrarily large dataLen values. When the Decode function processes these packets, it executes make([]byte, dataLen) to allocate memory based on the attacker-controlled size parameter, regardless of whether sufficient buffer space exists in the remaining packet data. This premature allocation occurs before any bounds checking or validation of the actual available data, creating a scenario where the system can be induced to allocate massive amounts of memory.
The operational impact of this vulnerability manifests as a remote unauthenticated denial of service condition that can overwhelm system resources through excessive memory allocation and subsequent garbage collection pressure. An attacker can repeatedly send malicious packets with large dataLen values, causing the target system to consume disproportionate amounts of memory and CPU cycles. This resource exhaustion directly impacts the availability of the service by consuming system resources that could otherwise be used for legitimate operations, potentially leading to system instability or complete service unavailability.
This vulnerability aligns with CWE-129 Input Validation and CWE-704 Incorrect Calculation, specifically targeting improper validation of input parameters before memory allocation. The flaw also maps to attack techniques described in the MITRE ATT&CK framework under T1499 Endpoint Resource Exhaustion, where adversaries consume system resources to prevent legitimate use of services. The issue demonstrates a failure in proper input sanitization and boundary checking mechanisms that should validate attacker-provided data against available buffer limits before any resource allocation occurs.
The fix implemented in version 0.145.1 addresses this vulnerability by introducing proper bounds checking and validation of the dataLen parameter against the remaining packet buffer size. This ensures that memory allocation only occurs when sufficient data is available, preventing the exploitation of oversized data length values. The mitigation strategy requires validating all attacker-controlled parameters against known constraints before performing any memory allocation operations, implementing defensive programming practices that align with secure coding standards and industry best practices for resource management in network protocols.