{"id":"GO-2026-6138","revision":"676f5cb9eccf461b8568771c053fcaa4","records":[{"revision":"676f5cb9eccf461b8568771c053fcaa4","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GO-2026-6138","aliases":["CVE-2026-54638","GHSA-whmm-qj9r-wvr2"],"title":"Unbounded memory allocation in proto.UnencryptedMessage.Decode in github.com/gotd/td","description":"Unbounded memory allocation in proto.UnencryptedMessage.Decode in github.com/gotd/td","state":0,"publishedAt":"2026-08-18T16:38:10+00:00","modifiedAt":"2026-08-18T17:15:27.9218153+00:00","affected":[{"ecosystem":"Go","name":"github.com/gotd/td","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"0.145.1"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[],"references":["https://github.com/gotd/td/security/advisories/GHSA-whmm-qj9r-wvr2","https://github.com/gotd/td/commit/9d5d1f31ea5022d9798d84ccce15de2e91ba6baa","https://github.com/gotd/td/issues/1711","https://github.com/gotd/td/releases/tag/v0.145.1"],"sourceUrl":"https://osv.dev/vulnerability/GO-2026-6138","license":"OSV · upstream source license applies","key":"osv:GO-2026-6138","identifiers":["GO-2026-6138","CVE-2026-54638","GHSA-whmm-qj9r-wvr2"]},"retained":false,"historicalAffected":[]}],"coverage":[]}