CVE-2026-54638 gotd CVE debrief

Who should care

Defenders responsible for systems using the gotd/td Telegram MTProto API client in Go should assess exposure and prioritize verifying and upgrading to version 0.145.1 or later to mitigate this denial of service vulnerability.

Why it matters

Defenders should prioritize verifying and upgrading to version 0.145.1 or later to mitigate this denial of service vulnerability in the gotd/td Telegram MTProto API client in Go. The vulnerability allows for remote unauthenticated denial of service through excessive memory allocation and CPU or garbage collection pressure. Evidence is based on official CVE and NVD records, and source references from the gotd/td project.

• Denial of service through excessive memory allocation and CPU or garbage collection pressure
• Potential for system crashes or performance degradation
• Need for verification and upgrade to version 0.145.1 or later

Technical summary

The proto.UnencryptedMessage.Decode function in proto/unencrypted_message.go reads attacker-controlled dataLen from an unauthenticated MTProto unencrypted packet and allocates make([]byte, dataLen) before checking the remaining buffer, allowing remote unauthenticated denial of service through excessive memory allocation and CPU or garbage collection pressure. This vulnerability allows for remote unauthenticated denial of service through excessive memory allocation and CPU or garbage collection pressure, and it is fixed in version 0.145.1.

Defensive priority

Defenders should prioritize verifying and upgrading to version 0.145.1 or later to mitigate this denial of service vulnerability.

Recommended defensive actions

• Verify and upgrade to version 0.145.1 or later
• Review and monitor network traffic for potential denial of service attempts
• Implement compensating controls to limit the impact of a potential denial of service
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The vulnerability is caused by proto.UnencryptedMessage.Decode in proto/unencrypted_message.go reading attacker-controlled dataLen from an unauthenticated MTProto unencrypted packet and allocating make([]byte, dataLen) before checking the remaining buffer.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.