gotd CVE debriefs

These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.

HIGH gotd CVE published 2026-07-28

CVE-2026-54638

A vulnerability in the gotd/td Telegram MTProto API client in Go, prior to version 0.145.1, allows for remote unauthenticated denial of service through excessive memory allocation and CPU or garbage collection pressure. This issue is fixed in version 0.145.1. The vulnerability is caused by proto.UnencryptedMessage.Decode in proto/unencrypted_message.go reading attacker-controlled dataLen from an unauthent [truncated]