-------------------- Start of forwarded message -------------------- Date: Sat, 5 Sep 2026 19:31:16 +0200 From: Sébastien Helleu <flashcode () flashtux org> To: weechat-security () nongnu org Subject: Security vulnerabilities fixed in WeeChat 4.10.1

Hi all,

Six security vulnerabilities have been fixed in WeeChat 4.10.1, which was released on September 5th, 2026:

- WSA-2026-15: [Xfer] Write of DCC file received outside of configured download path. - WSA-2026-16: [Xfer] Missing size limit for the unterminated Xfer chat message. - WSA-2026-17: [Xfer] Bypass of user authorization for start of DCC file transfer. - WSA-2026-18: [Relay] Missing size limit for the unterminated Relay text message received from a client. - WSA-2026-19: [Relay] Missing rejection of invalid websocket frames. - WSA-2026-20: [Relay] Missing size limit of data queued for sending to clients.

For more information, see the security page: https://weechat.org/doc/weechat/security/

-- Sébastien Helleu

web: weechat.org / flashtux.org irc: FlashCode @ irc.libera.chat

-------------------- End of forwarded message --------------------

WeeChat (Wee Enhanced Environment for Chat) is a free chat client. In versions 0.3.1 through 4.9.0, the WeeChat relay authentication uses non-constant-time string comparison functions (weechatstrcasecmp and strcmp) to verify password hashes and plaintext passwords. An attacker can exploit timing differences to extract the server-computed hash character by character, then authenticate using the correct hash without knowing the password. Version 4.9.1 fixes the issue.

WeeChat (Wee Enhanced Environment for Chat) is a free chat client. In versions 4.3.0 through 4.9.0, the WeeChat relay module's WebSocket permessage-deflate decompression function relaywebsocketinflate() has no upper bound on output size. An authenticated relay user can send a small compressed WebSocket frame (~100 bytes) that decompresses to gigabytes, exhausting all server memory and crashing the entire WeeChat process. The api protocol enables permessage-deflate and requires authentication before WebSocket upgrade. Version 4.9.1 patches the issue.

Latest version: 4.10.1

WeeChat before 3.2.1 allows remote attackers to cause a denial of service (crash) via a crafted WebSocket frame that trigger an out-of-bounds read in plugins/relay/relay-websocket.c in the Relay plugin.

An issue was discovered in WeeChat before 2.7.1 (0.3.4 to 2.7 are affected). When a new IRC message 005 is received with longer nick prefixes, a buffer overflow and possibly a crash can happen when a new mode is set for a nick.

ircmodechannelupdate in plugins/irc/irc-mode.c in WeeChat through 2.7 allows remote attackers to cause a denial of service (buffer overflow and application crash) or possibly have unspecified other impact via a malformed IRC message 324 (channel mode).

WeeChat before 1.7.1 allows a remote crash by sending a filename via DCC to the IRC plugin. This occurs in the ircctcpdccfilenamewithoutquotes function during quote removal, with a buffer overflow.

End of life: 8/2/2026, Latest version: 4.9.5

End of life: 3/29/2026, Latest version: 4.8.2