What is the CVSS score of CVE-2026-54638?

CVE-2026-54638 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.3%.

Is there a public PoC exploit available for CVE-2026-54638?

Yes, a public proof-of-concept exploit is available for CVE-2026-54638. Prioritise patching immediately. EPSS: 0.3%.

Is there a patch available for CVE-2026-54638?

Yes, a patch is available for CVE-2026-54638. Update the affected software to the latest version immediately.

Td CVE-2026-54638

EUVD-2026-50085 HIGH

Allocation of Resources Without Limits or Throttling (CWE-770)

2026-07-28 GitHub_M

GHSA-whmm-qj9r-wvr2

Denial Of Service Suse Td

7.5

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

SUSE

HIGH

qualitative

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Patch available

Jul 28, 2026 - 23:02 EUVD

Source Code Evidence Fetched

Jul 28, 2026 - 22:51 vuln.today

Analysis Generated

Jul 28, 2026 - 22:51 vuln.today

CVE Published

Jul 28, 2026 - 22:14 cve.org

HIGH 7.5

DescriptionCVE.org

gotd/td is a T Telegram MTProto API client in Go. Prior to 0.145.1, proto.UnencryptedMessage.Decode in proto/unencrypted_message.go read attacker controlled dataLen from an unauthenticated MTProto unencrypted packet and allocated make([]byte, dataLen) before checking the remaining buffer, allowing remote unauthenticated denial of service through excessive memory allocation and CPU or garbage collection pressure. This issue is fixed in version 0.145.1.

AnalysisAI

Remote denial of service in gotd/td versions before 0.145.1 allows unauthenticated attackers to exhaust memory and CPU by sending a crafted MTProto unencrypted packet with a maliciously inflated dataLen field, causing excessive allocation before length validation. No authentication or session is required, and the vulnerability is reachable during the handshake phase. There is no evidence of active exploitation and no public exploit has been identified.