Executive brief
A denial-of-service vulnerability exists in the gotd/td library, a Go-based client for the Telegram MTProto API. By sending a specially crafted network packet, an unauthenticated attacker can force the application to consume massive amounts of memory and processor power. This can lead to the application becoming unresponsive or being shut down by the operating system, disrupting services that rely on this library for Telegram communications.
Technical details
A resource exhaustion vulnerability (CWE-770/CWE-789) exists in the `proto.UnencryptedMessage.Decode` function within `proto/unencrypted_message.go`. The decoder reads a 32-bit `dataLen` field from an unauthenticated MTProto packet and immediately performs a heap allocation using `make([]byte, dataLen)` before verifying if the input buffer actually contains the claimed number of bytes. An attacker can send a small (e.g., 20-byte) packet with a large `dataLen` value (e.g., 1.75 GB) to trigger immediate memory zero-initialization and garbage collection pressure, leading to a Denial of Service (DoS) or Out-Of-Memory (OOM) termination. This occurs in the pre-authentication handshake path, requiring no credentials. The issue is fixed in version 0.145.1 by validating the length against the remaining buffer size before allocation.
Affected products
- gotd td < 0.145.1
Timeline
- 2026-05-17: disclosed: Issue reported by security researcher
- 2026-06-03: patched: Version 0.145.1 released
- 2026-06-08: advisory: GitHub Security Advisory published
- 2026-07-28: disclosed: NVD publication date