CVE-2026-53524

WeeChat (Wee Enhanced Environment for Chat) is a free chat client. In versions 4.3.0 through 4.9.0, the WeeChat relay module's WebSocket permessage-deflate decompression function relaywebsocketinflate() has no upper bound on output size. An authenticated relay user can send a small compressed WebSocket frame (~100 bytes) that decompresses to gigabytes, exhausting all server memory and crashing the entire WeeChat process. The api protocol enables permessage-deflate and requires authentication before WebSocket upgrade. Version 4.9.1 patches the issue.

Database specific

{
    "cwe_ids": [
        "CWE-409"
    ],
    "cna_assigner": "GitHub_M",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/53xxx/CVE-2026-53524.json"
}

References

Affected packages

Git / github.com/weechat/weechat

Affected ranges

Type

GIT

Repo

https://github.com/weechat/weechat

Events

Introduced

b407de4c3be2db851927acd0c09e9980d254e052

Fixed

2148829ebe47d8ac2377ef234162bf6b64c5b466

Database specific

Show details

{
    "source": [
        "AFFECTED_FIELD",
        "DESCRIPTION"
    ],
    "extracted_events": [
        {
            "introduced": "4.3.0"
        },
        {
            "fixed": "4.9.1"
        },
        {
            "fixed": "4.9.0"
        }
    ]
}

Affected versions

v4.*

v4.3.0

v4.4.0

v4.5.0

v4.6.0

v4.7.0

v4.8.0

v4.9.0

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-53524.json"