DEV Community

CVE Reports
CVE Reports

Posted on • Originally published at cvereports.com

CVE-2026-54638: CVE-2026-54638: Pre-Authentication Denial of Service via Unbounded Memory Allocation in gotd/td MTProto Parser

#security #cve #cybersecurity

CVE-2026-54638: Pre-Authentication Denial of Service via Unbounded Memory Allocation in gotd/td MTProto Parser

Vulnerability ID: CVE-2026-54638
CVSS Score: 7.5
Published: 2026-07-28

An unauthenticated remote Denial of Service (DoS) vulnerability exists in the plaintext message parsing implementation of gotd/td, a Go-based Telegram MTProto client and server library. The security flaw is located within the unencrypted message decoding pipeline, where the parser reads an untrusted length header and immediately performs a heap-based memory allocation without checking if the buffer contains the corresponding bytes. An attacker can exploit this behavior by sending a single crafted 20-byte packet containing an extremely large length value, leading to immediate memory exhaustion and process termination by the operating system Out-Of-Memory (OOM) killer.

TL;DR

A critical pre-authentication vulnerability in gotd/td (< 0.145.1) allows a remote attacker to crash the MTProto server or client with a single 20-byte TCP packet. The parser immediately allocates heap memory based on an unverified length header in unencrypted packets, triggering an out-of-memory crash or severe resource exhaustion prior to any validation.

⚠️ Exploit Status: POC

Technical Details

  • CWE ID: CWE-770, CWE-789
  • Attack Vector: Network
  • CVSS v3.1 Score: 7.5 (High)
  • Exploit Maturity: PoC Available
  • Impact: Denial of Service (OOM Crash)
  • KEV Status: Not Listed

Affected Systems

  • github.com/gotd/td
  • github.com/gotd/td: < 0.145.1 (Fixed in: 0.145.1)

Code Analysis

Commit: 9d5d1f3

Validate unencrypted message length before allocating buffer

@@ -37,6 +39,15 @@ func (u *UnencryptedMessage) Decode(b *bin.Buffer) error {
    if err != nil {
        return err
    }
+   if dataLen < 0 {
+       return &bin.InvalidLengthError{
+           Length: int(dataLen),
+           Where:  "plaintext message data",
+       }
+   }
+   if int(dataLen) > b.Len() {
+       return errors.Wrap(io.ErrUnexpectedEOF, "consume payload")
+   }
    u.MessageData = append(u.MessageData[:0], make([]byte, dataLen)...)
    if err := b.ConsumeN(u.MessageData, int(dataLen)); err != nil {
        return errors.Wrap(err, "consume payload")
Enter fullscreen mode Exit fullscreen mode

Exploit Details

  • GitHub: Vulnerability disclosure with reproducible Proof of Concept (PoC) code

Mitigation Strategies

  • Upgrade gotd/td dependency to version v0.145.1 or later
  • Deploy rate-limiting policies for incoming unauthenticated TCP connections
  • Implement application-level reverse proxies to filter out anomalous handshake packets
  • Enforce memory limits and automated container restart policies in orchestration platforms

Remediation Steps:

  1. Identify all microservices and Go binaries utilizing github.com/gotd/td
  2. Update the go.mod file of the affected services to request github.com/gotd/td v0.145.1
  3. Run 'go mod tidy' to update the dependency tree and lockfile
  4. Recompile the binaries using the patched version of the dependency
  5. Redeploy the updated services to production environments

References

Read the full report for CVE-2026-54638 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)