WeeChat :: documentation

WeeChat

All vulnerabilities
Vulnerabilities by version

Overview: 1 vulnerability

WSA	Score	Severity	Issue	Vulnerability type	Scope	Versions	Fix	Release date
WSA-2026-19	7.5		Missing rejection of invalid websocket frames.	Memory Allocation with Excessive Size Value	Relay	1.5 → 4.10.0	4.10.1	Sep 5, 2026

WSA-2026-19: [Relay] Missing rejection of invalid websocket frames.

Vulnerability

CVE

Not available

CVSS vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (detail)

CVSS score

7.5 / 10

Severity

high

Vulnerability type

Memory Allocation with Excessive Size Value (detail)

Scope

Relay

Affected versions

1.5 → 4.10.0

Fixed version

4.10.1 (Sep 5, 2026) - ChangeLog

Tracker

issue #2356

Commits

Description

The relay plugin fails to reject invalid websocket frames.
A malicious client sending invalid websocket frames can lead to memory exhaustion and the WeeChat process can be killed by the OOM killer.

Mitigation

Unload relay plugin with command: /plugin unload relay and see: /help weechat.plugin.autoload.

Credit

The issue was discovered by Acts1631.