CyberRota Analysis
AI-GeneratedThe vulnerability affects the gotd/td Telegram MTProto API client in Go, where the `proto.UnencryptedMessage.Decode` function improperly handles attacker-controlled data length from unauthenticated packets. This flaw can lead to remote unauthenticated denial of service by causing excessive memory allocation and CPU or garbage collection pressure. Organizations using versions prior to 0.145.1 should prioritize updating to the patched version to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
gotd/td is a T Telegram MTProto API client in Go. Prior to 0.145.1, proto.UnencryptedMessage.Decode in proto/unencrypted_message.go read attacker controlled dataLen from an unauthenticated MTProto unencrypted packet and allocated make([]byte, dataLen) before checking the remaining buffer, allowing remote unauthenticated denial of service through excessive memory allocation and CPU or garbage collection pressure. This issue is fixed in version 0.145.1.