https://seclists.org/oss-sec/2026/q3/658: Fwd: Security vulnerabilities fixed in WeeChat 4.10.1
Published Sep 5, 2026
·Updated
Affected Software
1 affected component
WeeChat WeeChat=4.10.1
The fixes affect the Xfer component, including DCC file transfers and Xfer chat messages, and the Relay component, including Relay text messages, WebSocket frames, and data queued for Relay clients.
Prioritize deployments that use Xfer/DCC transfers or expose Relay services to clients. The reported issues include writing received DCC files outside the configured download path, bypassing authorization for DCC transfer start, and multiple missing message or queue size limits.
WeeChat 4.10.1 contains fixes for all six reported vulnerabilities and was released on September 5, 2026.