td has pre-auth denial of service via unbounded memory allocation in proto.UnencryptedMessage.Decode

Impact A remote, unauthenticated attacker can cause excessive memory allocation and resulting CPU / GC pressure, potentially OOM termination by sending a crafted unencrypted MTProto packet. proto.UnencryptedMessage.Decode read an attacker-controlled 32-bit dataLen field and immediately allocated ...

GHSA-WHMM-QJ9R-WVR2 td has pre-auth denial of service via unbounded memory allocation in proto.UnencryptedMessage.Decode

Impact A remote, unauthenticated attacker can cause excessive memory allocation and resulting CPU / GC pressure, potentially OOM termination by sending a crafted unencrypted MTProto packet. proto.UnencryptedMessage.Decode read an attacker-controlled 32-bit dataLen field and immediately allocated ...

EUVD-2026-50085

gotd/td is a T Telegram MTProto API client in Go. Prior to 0.145.1, proto.UnencryptedMessage.Decode in proto/unencryptedmessage.go read attacker controlled dataLen from an unauthenticated MTProto unencrypted packet and allocated makebyte, dataLen before checking the remaining buffer, allowing...

CVE-2026-54638 td has pre-auth denial of service via unbounded memory allocation in proto.UnencryptedMessage.Decode

gotd/td is a T Telegram MTProto API client in Go. Prior to 0.145.1, proto.UnencryptedMessage.Decode in proto/unencryptedmessage.go read attacker controlled dataLen from an unauthenticated MTProto unencrypted packet and allocated makebyte, dataLen before checking the remaining buffer, allowing...

CVE-2026-59803

rpcx through 1.9.3, fixed in commit 047aec1, contains a denial-of-service vulnerability in protocol.Message.Decode protocol/message.go. When a message has the compression flag set, the payload is gzip-decompressed via util.Unzip with no limit on the decompressed output size. The only built-in siz...

CVE-2026-59803 rpcx - Denial of Service via Gzip Decompression Bomb in Wire Protocol

rpcx through 1.9.3, fixed in commit 047aec1, contains a denial-of-service vulnerability in protocol.Message.Decode protocol/message.go. When a message has the compression flag set, the payload is gzip-decompressed via util.Unzip with no limit on the decompressed output size. The only built-in siz...

PT-2025-2372

Name of the Vulnerable Software and Affected Versions: Magma versions 1.8.0 and earlier Description: A type confusion in the nas message decode function allows attackers to execute arbitrary code or cause a Denial of Service DoS via a crafted NAS packet. This issue can lead to persistent denial o...

PT-2021-27886

Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned in the provided description. Description A heap-buffer-overflow READ 1 crash has been reported. The crash involves the following functions: consume list, pn amqp decode DqEoQBIoIe, and pn message...

qpid-proton:fuzz-message-decode: Heap-buffer-overflow in consume_list

Project: https://github.com/apache/qpid-proton.git Detailed Report: https://oss-fuzz.com/testcase?key=6101905114267648 Project: qpid-proton Fuzzing Engine: libFuzzer Fuzz Target: fuzz-message-decode Job Type: libfuzzerasanqpid-proton Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Cras...

PT-2021-27524

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided description. Description: The issue is related to a stack-buffer-overflow read error. Technical details include a crash type of Stack-buffer-overflow READ 2, and the crash state...

PT-2020-14073

Name of the Vulnerable Software and Affected Versions Contiki-NG versions 4.4 through 4.5 Description A buffer overflow issue was found in the SNMP agent of Contiki-NG, specifically in functions that parse OIDs in SNMP requests. The snmp oid decode oid function lacks sufficient verification of th...

qpid-proton/fuzz-message-decode: Heap-buffer-overflow in pni_decoder_decode_value

Project: https://github.com/apache/qpid-proton.git Detailed report: https://oss-fuzz.com/testcase?key=5311329584807936 Project: qpid-proton Fuzzer: aflqpid-protonfuzz-message-decode Fuzz target binary: fuzz-message-decode Job Type: aflasanqpid-proton Platform Id: linux Crash Type:...