{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","feed_url":"https://feed.craftedsignal.io/vendors/gotd/feed.json","home_page_url":"https://feed.craftedsignal.io/","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["go/github.com/gotd/td (\u003c 0.145.1)"],"_cs_severities":["high"],"_cs_tags":["denial-of-service","vulnerability","go-lang"],"_cs_type":"advisory","_cs_vendors":["gotd"],"content_html":"\u003cp\u003eA high-severity denial-of-service vulnerability, tracked as CVE-2026-54638, affects the \u003ccode\u003ego/github.com/gotd/td\u003c/code\u003e library versions prior to 0.145.1. This flaw stems from an unbounded memory allocation in the \u003ccode\u003e(*proto.UnencryptedMessage).Decode\u003c/code\u003e function. A remote, unauthenticated attacker can exploit this by sending a specially crafted unencrypted MTProto packet during the initial handshake phase. The packet includes a manipulated 32-bit \u003ccode\u003edataLen\u003c/code\u003e field that declares a multi-gigabyte payload. Critically, the vulnerable function attempts to allocate a buffer of the declared size \u003cem\u003ebefore\u003c/em\u003e validating that the actual incoming data stream contains the specified number of bytes. This premature allocation of excessive memory can lead to significant CPU and garbage collection pressure, and ultimately, Out-Of-Memory (OOM) termination, rendering the affected application unavailable. There is no evidence of memory corruption or code execution associated with this vulnerability.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eA remote, unauthenticated attacker initiates communication with a service using the \u003ccode\u003ego/github.com/gotd/td\u003c/code\u003e library, targeting the MTProto handshake path.\u003c/li\u003e\n\u003cli\u003eThe attacker crafts an unencrypted MTProto packet containing a manipulated 32-bit \u003ccode\u003edataLen\u003c/code\u003e field, declaring an arbitrarily large payload size (e.g., \u003ccode\u003e0x70000000\u003c/code\u003e, approximately 1.75 GB).\u003c/li\u003e\n\u003cli\u003eThe crafted packet is sent to the vulnerable application.\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003e(*proto.UnencryptedMessage).Decode\u003c/code\u003e function receives the packet.\u003c/li\u003e\n\u003cli\u003eBefore validating if the incoming buffer actually contains the declared \u003ccode\u003edataLen\u003c/code\u003e number of bytes, the function attempts to allocate a buffer of that size using \u003ccode\u003emake([]byte, dataLen)\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eThis forced allocation of a multi-gigabyte buffer consumes an excessive amount of system memory.\u003c/li\u003e\n\u003cli\u003eThe application experiences high CPU and garbage collection (GC) pressure due to the memory allocation attempt.\u003c/li\u003e\n\u003cli\u003eThe system runs out of memory, causing the application to crash or terminate (Out-Of-Memory), resulting in a denial-of-service condition.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe primary impact of CVE-2026-54638 is a denial-of-service against applications using the vulnerable \u003ccode\u003ego/github.com/gotd/td\u003c/code\u003e library. Successful exploitation by a remote, unauthenticated attacker will cause excessive memory allocation, leading to significant CPU and garbage collection overhead, and potentially an Out-Of-Memory (OOM) termination of the application. This renders the service unavailable to legitimate users. The vulnerability specifically targets system availability and does not lead to memory corruption, out-of-bounds access, or remote code execution.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade the \u003ccode\u003ego/github.com/gotd/td\u003c/code\u003e library to version 0.145.1 or later to patch CVE-2026-54638.\u003c/li\u003e\n\u003cli\u003eEnsure that all applications using the \u003ccode\u003ego/github.com/gotd/td\u003c/code\u003e package are updated to a non-vulnerable version to mitigate the risk of denial-of-service attacks.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-07-28T22:17:12Z","date_published":"2026-07-28T22:17:12Z","id":"https://feed.craftedsignal.io/briefs/2026-07-td-dos-unbounded-memory/","summary":"A denial-of-service vulnerability exists in the `go/github.com/gotd/td` library versions prior to 0.145.1. A remote, unauthenticated attacker can exploit this by sending a crafted unencrypted MTProto packet during the handshake. This packet declares a large `dataLen` value, forcing the application to allocate an excessive amount of memory, potentially leading to out-of-memory (OOM) termination and denial of service due to unbounded memory allocation before length validation.","title":"td Library Denial of Service via Unbounded Memory Allocation","url":"https://feed.craftedsignal.io/briefs/2026-07-td-dos-unbounded-memory/"}],"language":"en","title":"CraftedSignal Threat Feed - Gotd","version":"https://jsonfeed.org/version/1.1"}