https://seclists.org/oss-sec/2026/q3/658: Fwd: Security vulnerabilities fixed in WeeChat 4.10.1
Published Sep 5, 2026
·Updated
Affected Software
1 affected component
WeeChat WeeChat=4.10.1
Frequently Asked Questions
1
Which WeeChat features are implicated by these fixes?
The fixes affect the Xfer component, including DCC file transfers and Xfer chat messages, and the Relay component, including Relay text messages, WebSocket frames, and data queued for Relay clients.
2
What exposure should administrators prioritize when triaging this update?
Prioritize deployments that use Xfer/DCC transfers or expose Relay services to clients. The reported issues include writing received DCC files outside the configured download path, bypassing authorization for DCC transfer start, and multiple missing message or queue size limits.
3
What release contains the fixes?
WeeChat 4.10.1 contains fixes for all six reported vulnerabilities and was released on September 5, 2026.