CVE-2026-54638 Overview
CVE-2026-54638 is an unauthenticated denial-of-service vulnerability in gotd/td, a Go implementation of the Telegram MTProto API client. The flaw resides in proto.UnencryptedMessage.Decode inside proto/unencrypted_message.go. The decoder reads an attacker-controlled dataLen field from an unauthenticated MTProto packet and calls make([]byte, dataLen) before validating the remaining buffer length. A remote attacker can trigger excessive memory allocation, driving CPU consumption and garbage collection pressure. The issue is categorized under [CWE-770] (Allocation of Resources Without Limits or Throttling) and is fixed in version 0.145.1.
Critical Impact
Remote unauthenticated attackers can exhaust host memory and CPU on any service embedding vulnerable gotd/td versions by sending crafted MTProto unencrypted packets.
Affected Products
- gotd/td Go module — all versions prior to 0.145.1
- Applications embedding the proto package for MTProto message decoding
- Telegram bots, MTProto relays, and clients built on gotd/td
Discovery Timeline
- 2026-07-28 - CVE-2026-54638 published to NVD
- 2026-07-29 - Last updated in NVD database
Technical Details for CVE-2026-54638
Vulnerability Analysis
The gotd/td library implements Telegram's MTProto protocol in Go. Unencrypted MTProto messages carry a length-prefixed payload used during initial key exchange. The UnencryptedMessage.Decode function reads the dataLen field directly from the wire and allocates a byte slice of that size before verifying that the input buffer contains enough remaining data. Because the field is a 32-bit integer under attacker control, a single malformed packet can request allocations up to gigabytes in size. Go's runtime honors the allocation request, triggering heap growth, aggressive garbage collection, and eventual out-of-memory conditions.
Exploitation requires no authentication and no user interaction. The attack is repeatable, and multiple concurrent connections amplify the resource pressure. The confidentiality and integrity of data are not affected, but availability of the affected service is fully compromised.
Root Cause
The root cause is missing input validation between untrusted length metadata and the resource allocation call. The decoder must confirm that dataLen does not exceed the remaining bytes in the input buffer before invoking make([]byte, dataLen). Without this bounds check, the length field acts as a resource-exhaustion primitive.
Attack Vector
An attacker sends a crafted MTProto unencrypted packet to any network endpoint that invokes UnencryptedMessage.Decode. The packet declares a large dataLen value while carrying minimal payload bytes. The decoder allocates the full requested slice before returning an error for the truncated buffer.
// Security patch in proto/unencrypted_message.go
// fix(proto): validate plaintext message length before allocation
package proto
import (
+ "io"
+
"github.com/go-faster/errors"
"github.com/gotd/td/bin"
Source: gotd/td commit 9d5d1f3. The patch imports io to compare the declared length against the remaining buffer size and returns an error before allocation when the payload is truncated.
Detection Methods for CVE-2026-54638
Indicators of Compromise
- Sudden spikes in resident memory usage or Go runtime heap size in processes linking gotd/td versions below 0.145.1.
- Repeated OOMKilled events or runtime: out of memory panics in service logs shortly after receiving inbound MTProto traffic.
- Elevated garbage collection pause times reported by Go runtime metrics such as go_gc_duration_seconds.
Detection Strategies
- Inventory Go build manifests (go.mod, go.sum) and container images for github.com/gotd/td at versions prior to 0.145.1.
- Instrument affected services with runtime metrics and alert on abnormal allocation rates or heap growth per connection.
- Inspect MTProto traffic at the network layer for unencrypted messages declaring data_length values inconsistent with observed payload sizes.
Monitoring Recommendations
- Ship Go runtime metrics (runtime.MemStats, pprof allocations) to a centralized observability platform for anomaly detection.
- Monitor per-source connection rates to MTProto listeners and rate-limit peers producing repeated decode failures.
- Correlate process crash events with upstream network sources to attribute exhaustion attempts.
How to Mitigate CVE-2026-54638
Immediate Actions Required
- Upgrade the github.com/gotd/td dependency to version 0.145.1 or later and rebuild all affected binaries and container images.
- Restart running services after redeployment to ensure no long-lived processes retain the vulnerable code path.
- Place inbound MTProto endpoints behind connection rate-limiting and per-source concurrency caps until patched builds are deployed.
Patch Information
The fix is delivered in the gotd/td v0.145.1 release. The change adds a length validation step in proto/unencrypted_message.go that compares the declared dataLen against the remaining buffer before allocation, returning io.ErrUnexpectedEOF when the payload is truncated. Refer to the GitHub Security Advisory GHSA-whmm-qj9r-wvr2 and the upstream issue discussion for background.
Workarounds
- Restrict network exposure of services embedding gotd/td so that only trusted peers can reach MTProto listeners.
- Enforce process-level memory limits (for example, MemoryMax in systemd or container cgroup limits) so exhaustion attempts terminate a single instance rather than the host.
- Deploy a reverse proxy or firewall rule that caps inbound packet size and per-connection request rate for MTProto endpoints.
# Update the vulnerable dependency to the patched version
go get github.com/gotd/td@v0.145.1
go mod tidy
go build ./...
# Verify the resolved version
go list -m github.com/gotd/td
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
