The vulnerability resides in the proto.UnencryptedMessage.Decode routine of the gotd/td Telegram MTProto client. An attacker can control the dataLen field in an unencrypted MTProto packet. Before validating the packet length, the code allocates a slice of that size, allowing the attacker to request an arbitrarily large allocation. This leads to excessive memory usage and application instability without any authentication requirement, effectively causing a denial of service. The weakness maps to CWE-770 and CWE-789.

The affected product is the gotd/td Go MTProto client. All releases prior to version 0.145.1 are vulnerable. The fixed release is 0.145.1 and later.

The CVSS score of 7.5 indicates a serious risk. The EPSS score is below 1 %, suggesting that exploitation is currently unlikely, and the vulnerability is not listed in CISA’s KEV catalogue. The flaw is exploitable remotely by an unauthenticated attacker who can send a crafted unencrypted packet to the client; no other credentials or privileged access are required. Successful exploitation would exhaust system memory or heavily tax the garbage collector, leading to service unavailability.