{"uuid": "fba277d0-f9df-457a-8213-9bfdd75bc2de", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-54638", "type": "seen", "source": "https://gist.github.com/alon710/7cdf75a52c50aebac3f872ab5cf7bfbf", "content": "# CVE-2026-54638: CVE-2026-54638: Pre-Authentication Denial of Service via Unbounded Memory Allocation in gotd/td MTProto Parser\n\n> **CVSS Score:** 7.5\n> **Published:** 2026-07-28\n> **Full Report:** https://cvereports.com/reports/CVE-2026-54638\n\n## Summary\nAn unauthenticated remote Denial of Service (DoS) vulnerability exists in the plaintext message parsing implementation of gotd/td, a Go-based Telegram MTProto client and server library. The security flaw is located within the unencrypted message decoding pipeline, where the parser reads an untrusted length header and immediately performs a heap-based memory allocation without checking if the buffer contains the corresponding bytes. An attacker can exploit this behavior by sending a single crafted 20-byte packet containing an extremely large length value, leading to immediate memory exhaustion and process termination by the operating system Out-Of-Memory (OOM) killer.\n\n## TL;DR\nA critical pre-authentication vulnerability in gotd/td (< 0.145.1) allows a remote attacker to crash the MTProto server or client with a single 20-byte TCP packet. The parser immediately allocates heap memory based on an unverified length header in unencrypted packets, triggering an out-of-memory crash or severe resource exhaustion prior to any validation.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-770, CWE-789\n- **Attack Vector**: Network\n- **CVSS v3.1 Score**: 7.5 (High)\n- **Exploit Maturity**: PoC Available\n- **Impact**: Denial of Service (OOM Crash)\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- github.com/gotd/td\n- **github.com/gotd/td**: < 0.145.1 (Fixed in: `0.145.1`)\n\n## Mitigation\n\n- Upgrade gotd/td dependency to version v0.145.1 or later\n- Deploy rate-limiting policies for incoming unauthenticated TCP connections\n- Implement application-level reverse proxies to filter out anomalous handshake packets\n- Enforce memory limits and automated container restart policies in orchestration platforms\n\n**Remediation Steps:**\n1. Identify all microservices and Go binaries utilizing github.com/gotd/td\n2. Update the go.mod file of the affected services to request github.com/gotd/td v0.145.1\n3. Run 'go mod tidy' to update the dependency tree and lockfile\n4. Recompile the binaries using the patched version of the dependency\n5. Redeploy the updated services to production environments\n\n## References\n\n- [Official GitHub Advisory](https://github.com/gotd/td/security/advisories/GHSA-whmm-qj9r-wvr2)\n- [Vulnerability Disclosure Issue](https://github.com/gotd/td/issues/1711)\n- [Fix Commit Link](https://github.com/gotd/td/commit/9d5d1f31ea5022d9798d84ccce15de2e91ba6baa)\n- [Official v0.145.1 Release Details](https://github.com/gotd/td/releases/tag/v0.145.1)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-54638) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-07-29T05:32:48.014593Z"}