When receiving part of Xfer chat message, the Xfer plugin builds a partial buffer until the end of message is found.
There is no limit for the allocated buffer.
A malicious client sending large amount of data without end of message can lead to memory exhaustion and the WeeChat process can be killed by the OOM killer.
Mitigation
Unload xfer plugin with command: /plugin unload xfer and see: /help weechat.plugin.autoload.