When connecting to a remote relay (command /remote), WeeChat sends a handshake request and the remote replies with the password hash algorithm and the number of hash iterations to use for authentication.
The number of iterations is not checked: a malicious remote, or a man-in-the-middle when the connection is not secured with TLS, can send a huge number of iterations (up to about 2 billion), so that WeeChat is blocked for a very long time while computing the password hash with the algorithm pbkdf2+sha256 or pbkdf2+sha512.
With the fix, the number of iterations must be between 1 and 1000000 (the range allowed in option relay.network.password_hash_iterations), otherwise the handshake fails and WeeChat disconnects from the remote.
Mitigation
There are multiple ways to mitigate this issue:
Connect only to trusted remote relays
Connect only with TLS (URL starting with https://) and certificate verification enabled (default), to prevent man-in-the-middle attacks, see: /help remote and option relay.remote.xxx.tls_verify