Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
gotd/td is a T Telegram MTProto API client in Go. Prior to 0.145.1, proto.UnencryptedMessage.Decode in proto/unencrypted_message.go read attacker controlled dataLen from an unauthenticated MTProto unencrypted packet and allocated make([]byte, dataLen) before checking the remaining buffer, allowing remote unauthenticated denial of service through excessive memory allocation and CPU or garbage collection pressure. This issue is fixed in version 0.145.1.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
CVE-2026-54638 gotd/td is a T Telegram MTProto API client in Go. Prior to 0.145.1, proto.UnencryptedMessage.Decode in proto/unencrypted_message.go read attacker controlled dataLen f… https://www.cve.org/CVERecord?id=CVE-2026-54638
Post summary
The message details a flaw in the gotd/td Go MTProto client where unencrypted message decoding reads an attacker‑controlled dataLen prior to version 0.145.1, constituting a disclosed vulnerability.
🚨*CVE* CVE-2026-54638 gotd/td is a T Telegram MTProto API client in Go. Prior to 0.145.1, proto.UnencryptedMessage.Decode in proto/unencrypted_message.go read attacker controlled dataLen f… https://www.cve.org/CVERecord?id=CVE-2026-54638 ----- Traducción: CVE-2026-54638 got… http://infoflow.cloud`
Post summary
The tweet announces CVE‑2026‑54638, a flaw in a Telegram MTProto API client that improperly handles attacker‑controlled length values in a Go library, but it offers no proof of exploitation, tools, or mitigation guidance.