CVE-2026-53524: WeeChat has a Decompression Bomb in Relay WebSocket (DoS)
WeeChat (Wee Enhanced Environment for Chat) is a free chat client. In versions 4.3.0 through 4.9.0, the WeeChat relay module's WebSocket permessage-deflate decompression function relaywebsocketinflate() has no upper bound on output size. An authenticated relay user can send a small compressed WebSocket frame (~100 bytes) that decompresses to gigabytes, exhausting all server memory and crashing the entire WeeChat process. The api protocol enables permessage-deflate and requires authentication before WebSocket upgrade. Version 4.9.1 patches the issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WeeChat relay module (Relay WebSocket permessage-deflate)to a version that resolves this vulnerability.Fixed in 4.9.1
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated WeeChat relay user can exploit it through the relay module's WebSocket API protocol. The attacker must be able to authenticate before the WebSocket upgrade.
Are all relay connections affected?
The issue is associated with the WebSocket API protocol, which enables permessage-deflate. The provided information does not indicate that non-WebSocket relay protocols are affected.
What is the impact of successful exploitation?
A small compressed WebSocket frame can expand to gigabytes during decompression, exhausting server memory and crashing the entire WeeChat process. The stated impact is denial of service; no confidentiality or integrity impact is identified.
Which versions need remediation?
WeeChat versions 4.3.0 through 4.9.0 are affected. Version 4.9.1 patches the issue.