When receiving an HTTP request from a client, the Relay plugin keeps all the header lines received until the end of headers is found.
There is no limit for the allocated buffer, and this happens before the client is authenticated.
A malicious unauthenticated client sending an unlimited number of header lines can lead to memory exhaustion and the WeeChat process can be killed by the OOM killer.
Mitigation
Unload relay plugin with command: /plugin unload relay and see: /help weechat.plugin.autoload.
Credit
The issue was discovered by smaeljaish771.
WSA-2026-23: [Core] Heap buffer overflow in charset conversion.
The output buffer used for charset conversion was allocated with 4 bytes per input byte, but some charsets like TSCII produce more (up to 12 bytes), and the replacement char "?" for invalid chars was written without checking the remaining size, so the output buffer could overflow.
For example a malicious IRC server, or any user sending a message on a channel, could trigger the overflow when the decode charset is set to TSCII.
Note: the default decode charset iso-8859-1 is not affected.
Mitigation
Do not use charset TSCII for decoding: check option charset.default.decode and the options in section "decode" of charset plugin, see: /help charset.
Credit
The issue was discovered by nexrin.
WSA-2026-22: [Relay] Heap buffer overflow in path of hdata sent to clients with "weechat" protocol.
The path of hdata returned to the client with the "weechat" protocol is built in a buffer allocated with twice the length of the path received, but a variable name can be replaced by a hdata name more than twice longer (for example "next_nick" replaced by "irc_channel_speaking"), so that an authenticated client can write out of bounds with a path containing many such variables.
Mitigation
There are multiple ways to mitigate this issue:
Remove all relays with protocol "weechat", see: /help relay
Unload relay plugin with command: /plugin unload relay and see: /help weechat.plugin.autoload
Credit
The issue was discovered by smaeljaish771.
WSA-2026-20: [Relay] Missing size limit of data queued for sending to clients.
When queuing data of sending to clients, the Relay plugin builds a partial buffer.
There is no limit for the allocated buffer.
A malicious unauthenticated client sending PING control frames can can lead to memory exhaustion and the WeeChat process can be killed by the OOM killer.
Mitigation
Unload relay plugin with command: /plugin unload relay and see: /help weechat.plugin.autoload.
Credit
The issue was discovered by Acts1631.
WSA-2026-19: [Relay] Missing rejection of invalid websocket frames.
The relay plugin fails to reject invalid websocket frames.
A malicious client sending invalid websocket frames can lead to memory exhaustion and the WeeChat process can be killed by the OOM killer.
Mitigation
Unload relay plugin with command: /plugin unload relay and see: /help weechat.plugin.autoload.
Credit
The issue was discovered by Acts1631.
WSA-2026-18: [Relay] Missing size limit for the unterminated Relay text message received from a client.
When receiving a text message from a client, the Relay plugin builds a partial buffer until the end of text is found.
There is no limit for the allocated buffer.
A malicious client sending large amount of data without end of text can lead to memory exhaustion and the WeeChat process can be killed by the OOM killer.
Mitigation
Unload relay plugin with command: /plugin unload relay and see: /help weechat.plugin.autoload.
Credit
The issue was discovered by Acts1631.
WSA-2026-17: [Xfer] Bypass of user authorization for start of DCC file transfer.
When receiving part of Xfer chat message, the Xfer plugin builds a partial buffer until the end of message is found.
There is no limit for the allocated buffer.
A malicious client sending large amount of data without end of message can lead to memory exhaustion and the WeeChat process can be killed by the OOM killer.
Mitigation
Unload xfer plugin with command: /plugin unload xfer and see: /help weechat.plugin.autoload.
Credit
The issue was discovered by Acts1631.
WSA-2026-15: [Xfer] Write of DCC file received outside of configured download path.
When receiving a DCC file, the filename may contain directory separator that is not the platform-native one (for example "/" received on Windows or "\" received on Linux). This separator may be interpreted as a directory separator, so the file could be written outside of the configured download path.
Xfer never overwrites existing files, so if a file exists with the same name, a suffix like ".1" is appended to the filename.
Mitigation
Unload xfer plugin with command: /plugin unload xfer and see: /help weechat.plugin.autoload.
Credit
The issue was discovered by Acts1631.
WSA-2026-12: [IRC] Stack buffer overflow when building a JOIN command with channel keys.
When writing a log file, a specific char used internally as separator may be used to forge a new path that can be outside the path configured by the option logger.file.path.
Mitigation
There is no known mitigation.
The upgrade to the latest stable version is highly recommended.
Credit
The issue was discovered by Mohammed Arib (arib06).
WSA-2026-7: [Xfer] Buffer overflow when receiving a line in a Xfer chat (DCC chat) buffer.
When receiving a DCC file, the filename built contains the remote nick (the option xfer.file.use_nick_in_filename is on by default).
If the nick contains special characters, the file could be written outside of the configured download path.
Xfer never overwrites existing files, so if a file exists with the same name, a suffix like ".1" is appended to the filename.
Mitigation
Turn off option to include nick in filename: /set xfer.file.use_nick_in_filename off.
Credit
The issue was discovered by aizu-m.
WSA-2026-4: [Relay] Missing size limit for the received websocket frame, HTTP message and HTTP body.
When receiving part of websocket frame, HTTP message or HTTP body, the Relay plugin builds a partial buffer until the end of data is found.
There is no limit for the allocated buffer.
A malicious client sending large amount of data without end of websocket frame or HTTP message/body can lead to memory exhaustion and the WeeChat process can be killed by the OOM killer.
Mitigation
There are multiple ways to mitigate this issue:
Remove all relays, see: /help relay
Unload relay plugin with command: /plugin unload relay and see: /help weechat.plugin.autoload
Secure relay to allow only trusted IP addresses, see: /help relay.network.allowed_ips
WSA-2026-3: [IRC] Missing size limit for the unterminated IRC message or isupport value (message 005).
When receiving data on the socket, the IRC plugin builds a partial message until "\r\n" is found.
There is no limit for the allocated message.
A malicious server sending large amount of data without end of message ("\r\n") can lead to memory exhaustion and the WeeChat process can be killed by the OOM killer.
Mitigation
There is no known mitigation.
The upgrade to the latest stable version is highly recommended.
WSA-2026-2: [API, Relay] Non-constant time password/hash comparison.
WeeChat uses non-constant time password/hash comparison in the Relay plugin and in TOTP validation.
This could allow an attacker to guess a password, a hash or a TOTP and bypass relay authentication.
Mitigation
There are multiple ways to mitigate this issue:
Remove all relays, see: /help relay
Unload relay plugin with command: /plugin unload relay and see: /help weechat.plugin.autoload
Secure relay to allow only trusted IP addresses, see: /help relay.network.allowed_ips
Credit
The issue was discovered by Tristan Madani (TristanInSec).
WSA-2025-3: [Core] Integer overflow in conversion of version to an integer number.
Integer overflow happens in conversion of a version as string to an integer number, if the version is greater than 0x7FFFFFFF (127.255.255.255), so if the version is at least 0x80000000 (128.0.0.0).
Mitigation
There is no known mitigation.
The upgrade to the latest stable version is highly recommended.
WSA-2024-1: [Core, Plugins] Integer overflow in loops on lists.
An integer overflow can happen when looping over items in a list.
This can only happen in rare conditions on 32 and 64-bit systems, as the list must contain more than 2,147,483,647 elements.
On 16-bit systems, this happens with a list that contains more than 32,767 elements.
Mitigation
There is no known mitigation.
The upgrade to the latest stable version is highly recommended.
Credit
The issue was discovered by Yiheng Cao.
WSA-2021-1: [Relay] Crash on malformed websocket frame in relay plugin.
A crash happens when decoding a malformed websocket frame in relay plugin.
This happens even if a password is set in relay plugin, the malformed websocket frame can be received before the authentication of the client.
Mitigation
There are multiple ways to mitigate this issue:
Remove all relays, see: /help relay
Unload relay plugin with command: /plugin unload relay and see: /help weechat.plugin.autoload
Secure relay to allow only trusted IP addresses, see: /help relay.network.allowed_ips
Credit
The issue was discovered by Stuart Nevans Locke.
WSA-2020-3: [IRC] Buffer overflow on new IRC message 005 with nick prefixes.
A buffer overflow happens when a new IRC message 005 is received with longer nick prefixes.
Note: a "normal" IRC server should not send again a message 005 with new nick prefixes, so the problem should be limited to malicious IRC servers.
Mitigation
There is no known mitigation.
The upgrade to the latest stable version is highly recommended.
Credit
The issue was discovered by Stuart Nevans Locke.
WSA-2020-2: [IRC] Crash on malformed IRC message 352 (WHO).