CVE-2026-24738
📋 TL;DR
The gmrtd Go library for reading Machine Readable Travel Documents (MRTDs) has a vulnerability where ReadFile accepts TLV structures with lengths up to 4GB, causing unconstrained resource consumption. This allows malicious NFC devices or API calls to cause extreme slowdowns, memory exhaustion, and unresponsive threads. Projects using gmrtd to read NFC-based travel documents are affected.
💻 Affected Systems
- gmrtd Go library
📦 What is this software?
Gmrtd by Gmrtd
⚠️ Risk & Real-World Impact
Worst Case
Complete system resource exhaustion leading to denial of service, application crashes, and potential system instability on constrained devices like phones.
Likely Case
Application slowdowns, high memory consumption, and unresponsive threads when processing malicious NFC data.
If Mitigated
Minimal impact with proper input validation and resource limits in place.
🎯 Exploit Status
Exploitation requires sending malicious TLV data via NFC or API calls to ReadFile function.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 0.17.2
Vendor Advisory: https://github.com/gmrtd/gmrtd/security/advisories/GHSA-j49h-6577-5xwq
Restart Required: Yes
Instructions:
1. Update gmrtd dependency to version 0.17.2 or later. 2. Run 'go get github.com/gmrtd/gmrtd@v0.17.2'. 3. Rebuild and redeploy affected applications. 4. Restart services using the library.
🔧 Temporary Workarounds
Input validation wrapper
allAdd custom validation to limit TLV length before passing to ReadFile
// Go code to validate TLV length before processing
if tlvLength > 65535 { return error }
🧯 If You Can't Patch
- Implement rate limiting and monitoring for NFC/API endpoints using gmrtd
- Deploy resource limits (memory, CPU) on containers/processes using the library
🔍 How to Verify
Check if Vulnerable:
Check go.mod or go.sum for gmrtd version <0.17.2Check Version:
grep gmrtd go.mod || grep gmrtd go.sumVerify Fix Applied:
Confirm gmrtd version is 0.17.2 or higher in dependencies📡 Detection & Monitoring
Log Indicators:
- High memory consumption alerts
- Application slowdown logs
- Goroutine blocking warnings
Network Indicators:
- Unusually large NFC data transfers
- Extended API call durations
SIEM Query:
source="application.logs" AND ("memory exhaustion" OR "slow response" OR "goroutine blocked") AND process="*gmrtd*"