The relay plugin does not limit the length of IRC messages received from a client connected with the irc protocol: each message is fully parsed, including all its parameters, before the client is authenticated.
A message of a few megabytes with millions of parameters blocks WeeChat for a long time while it is parsed, and the memory used during parsing is much greater than the size of the message (hundreds of megabytes).
Any remote user able to connect to the relay port, without knowing the relay password, can freeze WeeChat and cause high CPU and memory usage, by sending such messages repeatedly.
With the fix, IRC messages longer than 4096 bytes are ignored and WeeChat replies with numeric 417 (ERR_INPUTTOOLONG), like IRC servers do.
Mitigation
There are multiple ways to mitigate this issue:
Do not use the relay with the irc protocol, see: /relay list and /help relay
Restrict the IP addresses allowed to connect to the relay, see: /help relay.network.allowed_ips
Listen only on a local address or a UNIX domain socket, see: /help relay.network.bind_address and /help relay