td has pre-auth denial of service via unbounded memory allocation in proto.UnencryptedMessage.Decode
A remote, unauthenticated attacker can cause excessive memory allocation (and resulting CPU / GC pressure, potentially OOM termination) by sending a crafted unencrypted MTProto packet. (*proto.UnencryptedMessage).Decode read an attacker-controlled 32-bit dataLen field and immediately allocated a buffer of that size via make([]byte, dataLen) before validating that the underlying buffer actually contained that many bytes. A 20-byte packet declaring a ~1.75 GB payload (e.g. dataLen = 0x70000000) forces the runtime to …