CVE-2026-53524
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk18th percentile - higher than 18% of all known CVEs
Summary
WeeChat versions 4.3.0 through 4.9.0 have a vulnerability in the WebSocket permessage-deflate decompression function relay_websocket_inflate() in the relay module, which has no upper bound on output size. An authenticated relay user can send a small compressed WebSocket frame (~100 bytes) that decompresses to gigabytes, exhausting all server memory and crashing the entire WeeChat process.
Risk Assessment
The attack can cause denial of service (DoS) by exhausting memory and crashing the chat client.
Recommendation
Update WeeChat to version 4.9.1 or later, which includes the fix.
Other vulnerabilities in WeeChat
See all- CVE-2017-8073High
WeeChat before 1.7.1 allows a remote crash by sending a filename via DCC to the IRC plugin. This occurs in the irc_ctcp_dcc_filename_without_quotes function during quote removal, leading to a buffer overflow.
- CVE-2026-53525High
WeeChat versions 0.3.1 through 4.9.0 use non-constant-time string comparison functions (weechat_strcasecmp and strcmp) to verify password hashes and plaintext passwords in relay authentication. An attacker can exploit timing differences to extract the server-computed hash character by character, then authenticate without knowing the password. Version 4.9.1 fixes the issue.
Original NVD description (English source)
WeeChat (Wee Enhanced Environment for Chat) is a free chat client. In versions 4.3.0 through 4.9.0, the WeeChat relay module's WebSocket permessage-deflate decompression function relay_websocket_inflate() has no upper bound on output size. An authenticated relay user can send a small compressed WebSocket frame (~100 bytes) that decompresses to gigabytes, exhausting all server memory and crashing the entire WeeChat process. The api protocol enables permessage-deflate and requires authentication before WebSocket upgrade. Version 4.9.1 patches the issue.