CVE-2026-24738

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-24738", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-01-26T19:06:16.059Z", "datePublished": "2026-01-27T21:08:29.392Z", "dateUpdated": "2026-01-28T15:16:31.785Z"}, "containers": {"cna": {"title": "gmrtd ReadFile Vulnerable to Denial of Service via Excessive TLV Length Values", "problemTypes": [{"descriptions": [{"cweId": "CWE-770", "lang": "en", "description": "CWE-770: Allocation of Resources Without Limits or Throttling", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-400", "lang": "en", "description": "CWE-400: Uncontrolled Resource Consumption", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "ADJACENT", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "userInteraction": "PASSIVE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 5.9, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "version": "4.0"}}], "references": [{"name": "https://github.com/gmrtd/gmrtd/security/advisories/GHSA-j49h-6577-5xwq", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/gmrtd/gmrtd/security/advisories/GHSA-j49h-6577-5xwq"}, {"name": "https://github.com/gmrtd/gmrtd/commit/54469a95e5a20a8602ac1457b2110bfeb80c8891", "tags": ["x_refsource_MISC"], "url": "https://github.com/gmrtd/gmrtd/commit/54469a95e5a20a8602ac1457b2110bfeb80c8891"}, {"name": "https://github.com/gmrtd/gmrtd/releases/tag/v0.17.2", "tags": ["x_refsource_MISC"], "url": "https://github.com/gmrtd/gmrtd/releases/tag/v0.17.2"}], "affected": [{"vendor": "gmrtd", "product": "gmrtd", "versions": [{"version": "< 0.17.2", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-01-27T21:08:29.392Z"}, "descriptions": [{"lang": "en", "value": "gmrtd is a Go library for reading Machine Readable Travel Documents (MRTDs). Prior to version 0.17.2, ReadFile accepts TLVs with lengths that can range up to 4GB, which can cause unconstrained resource consumption in both memory and cpu cycles. ReadFile can consume an extended TLV with lengths well outside what would be available in ICs. It can accept something all the way up to 4GB which would take too many iterations in 256 byte chunks, and would also try to allocate memory that might not be available in constrained environments like phones. Or if an API sends data to ReadFile, the same problem applies. The very small chunked read also locks the goroutine in accepting data for a very large number of iterations. projects using the gmrtd library to read files from NFCs can experience extreme slowdowns or memory consumption. A malicious NFC can just behave like the mock transceiver described above and by just sending dummy bytes as each chunk to be read, can make the receiving thread unresponsive and fill up memory on the host system. Version 0.17.2 patches the issue."}], "source": {"advisory": "GHSA-j49h-6577-5xwq", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-01-28T15:16:00.633201Z", "id": "CVE-2026-24738", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-28T15:16:31.785Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-24738", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-01-28T15:16:00.633201Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-28T15:16:24.304Z"}}], "cna": {"title": "gmrtd ReadFile Vulnerable to Denial of Service via Excessive TLV Length Values", "source": {"advisory": "GHSA-j49h-6577-5xwq", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 5.9, "attackVector": "ADJACENT", "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "userInteraction": "PASSIVE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE"}}], "affected": [{"vendor": "gmrtd", "product": "gmrtd", "versions": [{"status": "affected", "version": "< 0.17.2"}]}], "references": [{"url": "https://github.com/gmrtd/gmrtd/security/advisories/GHSA-j49h-6577-5xwq", "name": "https://github.com/gmrtd/gmrtd/security/advisories/GHSA-j49h-6577-5xwq", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/gmrtd/gmrtd/commit/54469a95e5a20a8602ac1457b2110bfeb80c8891", "name": "https://github.com/gmrtd/gmrtd/commit/54469a95e5a20a8602ac1457b2110bfeb80c8891", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/gmrtd/gmrtd/releases/tag/v0.17.2", "name": "https://github.com/gmrtd/gmrtd/releases/tag/v0.17.2", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "gmrtd is a Go library for reading Machine Readable Travel Documents (MRTDs). Prior to version 0.17.2, ReadFile accepts TLVs with lengths that can range up to 4GB, which can cause unconstrained resource consumption in both memory and cpu cycles. ReadFile can consume an extended TLV with lengths well outside what would be available in ICs. It can accept something all the way up to 4GB which would take too many iterations in 256 byte chunks, and would also try to allocate memory that might not be available in constrained environments like phones. Or if an API sends data to ReadFile, the same problem applies. The very small chunked read also locks the goroutine in accepting data for a very large number of iterations. projects using the gmrtd library to read files from NFCs can experience extreme slowdowns or memory consumption. A malicious NFC can just behave like the mock transceiver described above and by just sending dummy bytes as each chunk to be read, can make the receiving thread unresponsive and fill up memory on the host system. Version 0.17.2 patches the issue."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-770", "description": "CWE-770: Allocation of Resources Without Limits or Throttling"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-400", "description": "CWE-400: Uncontrolled Resource Consumption"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-01-27T21:08:29.392Z"}}}, "cveMetadata": {"cveId": "CVE-2026-24738", "state": "PUBLISHED", "dateUpdated": "2026-01-28T15:16:31.785Z", "dateReserved": "2026-01-26T19:06:16.059Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-01-27T21:08:29.392Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "gmrtd", "vendor": "gmrtd", "versions": [{"status": "affected", "version": "< 0.17.2"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:gmrtd:gmrtd:*:*:*:*:*:go:*:*", "matchCriteriaId": "BE705F0C-A471-470A-95EC-5C516461B97C", "versionEndExcluding": "0.17.2", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "gmrtd is a Go library for reading Machine Readable Travel Documents (MRTDs). Prior to version 0.17.2, ReadFile accepts TLVs with lengths that can range up to 4GB, which can cause unconstrained resource consumption in both memory and cpu cycles. ReadFile can consume an extended TLV with lengths well outside what would be available in ICs. It can accept something all the way up to 4GB which would take too many iterations in 256 byte chunks, and would also try to allocate memory that might not be available in constrained environments like phones. Or if an API sends data to ReadFile, the same problem applies. The very small chunked read also locks the goroutine in accepting data for a very large number of iterations. projects using the gmrtd library to read files from NFCs can experience extreme slowdowns or memory consumption. A malicious NFC can just behave like the mock transceiver described above and by just sending dummy bytes as each chunk to be read, can make the receiving thread unresponsive and fill up memory on the host system. Version 0.17.2 patches the issue."}, {"lang": "es", "value": "gmrtd es una librer\u00eda Go para leer Documentos de Viaje de Lectura Mec\u00e1nica (MRTDs). Antes de la versi\u00f3n 0.17.2, ReadFile acepta TLVs con longitudes que pueden oscilar hasta 4GB, lo que puede causar un consumo de recursos sin restricciones tanto en memoria como en ciclos de CPU. ReadFile puede consumir un TLV extendido con longitudes muy superiores a lo que estar\u00eda disponible en los ICs. Puede aceptar algo de hasta 4GB, lo que requerir\u00eda demasiadas iteraciones en bloques de 256 bytes, y tambi\u00e9n intentar\u00eda asignar memoria que podr\u00eda no estar disponible en entornos restringidos como los tel\u00e9fonos. O si una API env\u00eda datos a ReadFile, el mismo problema se aplica. La lectura en bloques muy peque\u00f1os tambi\u00e9n bloquea la goroutine al aceptar datos durante un n\u00famero muy grande de iteraciones. Los proyectos que utilizan la librer\u00eda gmrtd para leer archivos de NFCs pueden experimentar ralentizaciones extremas o consumo de memoria. Un NFC malicioso puede simplemente comportarse como el transceptor simulado descrito anteriormente y, simplemente enviando bytes ficticios como cada bloque a leer, puede hacer que el hilo receptor no responda y llenar la memoria del sistema anfitri\u00f3n. La versi\u00f3n 0.17.2 corrige el problema."}], "id": "CVE-2026-24738", "lastModified": "2026-06-17T10:23:30.700", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "ADJACENT", "availabilityRequirement": "NOT_DEFINED", "baseScore": 5.9, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "PASSIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-24738", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-01-28T15:16:00.633201Z", "version": "2.0.3"}}]}, "published": "2026-01-27T21:16:03.117", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/gmrtd/gmrtd/commit/54469a95e5a20a8602ac1457b2110bfeb80c8891"}, {"source": "security-advisories@github.com", "tags": ["Product", "Release Notes"], "url": "https://github.com/gmrtd/gmrtd/releases/tag/v0.17.2"}, {"source": "security-advisories@github.com", "tags": ["Vendor Advisory"], "url": "https://github.com/gmrtd/gmrtd/security/advisories/GHSA-j49h-6577-5xwq"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-400"}, {"lang": "en", "value": "CWE-770"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-18T01:55:46.388053+00:00", "value": {"mitigation_remediation": ["Upgrade the gmrtd library to version 0.17.2 or later where the TLV length validation is fixed.", "Add application\u2011level validation to reject TLV lengths beyond a reasonable threshold before calling ReadFile, ensuring that only expected size ranges are processed.", "Run the NFC reading routine in a sandboxed process or container with strict memory and CPU limits, and enforce a timeout to prevent prolonged blocking of the main application."], "summary": {"action": "Patch", "impact": "Denial of Service"}, "threat_synthesis": {"affected_systems": "The vulnerable code resides in the gmrtd Go library used to read Machine Readable Travel Documents. Any application that imports this library and reads data from NFC or other transports is impacted. Versions earlier than 0.17.2 are affected; the patch was shipped in release 0.17.2.", "description_and_impact": "ReadFile in the gmrtd Go library currently accepts TLV lengths of up to 4GB, leading to uncontrolled memory allocation and CPU consumption. An attacker can exploit this by sending a malformed TLV, causing the library to allocate or iterate many 256\u2011byte chunks and stall the goroutine. The result is a denial of service, aligning with CWE\u2011400 (Uncontrolled Resource Consumption) and CWE\u2011770 (Out\u2011of\u2011Bound array read).", "risk_and_exploitability": "The CVSS score of 5.9 indicates a moderate impact, but the EPSS score of less than 1% shows a very low likelihood of active exploitation. The vulnerability is not in CISA\u2019s KEV catalog. Attackers can trigger the issue by delivering a malicious NFC tag that emits TLVs with excessive lengths, which the library will process, consuming memory and CPU. This is a remote denial\u2011of\u2011service vector that can affect any device that reads contactless data through the library."}}}}, "created": "2026-01-28T12:22:18.157213+00:00", "updated": "2026-04-18T02:00:10.470224+00:00", "vendors": ["gmrtd", "gmrtd$PRODUCT$gmrtd"]}