Security vulnerabilities
This page lists vulnerabilities by version (click on a version for the detail of all issues).
No known security vulnerabilities.
Affected by 2 vulnerabilities:
-
WSA-2026-32: [Relay] Denial of service with many passwords in command init received from a relay client.
—
Fixed in version 4.10.4 ().
-
WSA-2026-31: [Relay] Bypass of TOTP and denial of service with invalid TOTP received from a relay client.
—
Fixed in version 4.10.4 ().
Affected by 7 vulnerabilities:
-
WSA-2026-32: [Relay] Denial of service with many passwords in command init received from a relay client.
—
Fixed in version 4.10.4 ().
-
WSA-2026-31: [Relay] Bypass of TOTP and denial of service with invalid TOTP received from a relay client.
—
Fixed in version 4.10.4 ().
-
WSA-2026-30: [Xfer] Incoming files and chats auto-accepted from a nick on the wrong server.
—
Fixed in version 4.10.3 ().
-
WSA-2026-29: [Relay] Missing check of the number of hash iterations received from a remote relay.
—
Fixed in version 4.10.3 ().
-
WSA-2026-28: [Xfer] Missing checks of the resume position received in DCC RESUME and DCC ACCEPT.
—
Fixed in version 4.10.3 ().
-
WSA-2026-27: [Relay] Denial of service with huge IRC messages received from a relay client.
—
Fixed in version 4.10.3 ().
-
WSA-2026-26: [IRC] Missing checks in SASL authentication with SCRAM mechanisms.
—
Fixed in version 4.10.3 ().
Affected by 12 vulnerabilities:
-
WSA-2026-32: [Relay] Denial of service with many passwords in command init received from a relay client.
—
Fixed in version 4.10.4 ().
-
WSA-2026-31: [Relay] Bypass of TOTP and denial of service with invalid TOTP received from a relay client.
—
Fixed in version 4.10.4 ().
-
WSA-2026-30: [Xfer] Incoming files and chats auto-accepted from a nick on the wrong server.
—
Fixed in version 4.10.3 ().
-
WSA-2026-29: [Relay] Missing check of the number of hash iterations received from a remote relay.
—
Fixed in version 4.10.3 ().
-
WSA-2026-28: [Xfer] Missing checks of the resume position received in DCC RESUME and DCC ACCEPT.
—
Fixed in version 4.10.3 ().
-
WSA-2026-27: [Relay] Denial of service with huge IRC messages received from a relay client.
—
Fixed in version 4.10.3 ().
-
WSA-2026-26: [IRC] Missing checks in SASL authentication with SCRAM mechanisms.
—
Fixed in version 4.10.3 ().
-
WSA-2026-25: [IRC] Evaluation of untrusted strings received from the IRC server or an IRC URL.
—
Fixed in version 4.10.2 ().
-
WSA-2026-24: [Relay] Missing size limit for HTTP headers received from a client.
—
Fixed in version 4.10.2 ().
-
WSA-2026-23: [Core] Heap buffer overflow in charset conversion.
—
Fixed in version 4.10.2 ().
-
WSA-2026-22: [Relay] Heap buffer overflow in path of hdata sent to clients with "weechat" protocol.
—
Fixed in version 4.10.2 ().
-
WSA-2026-21: [IRC] Heap buffer overflow in nick prefixes after a reconnection.
—
Fixed in version 4.10.2 ().
Affected by 18 vulnerabilities:
-
WSA-2026-32: [Relay] Denial of service with many passwords in command init received from a relay client.
—
Fixed in version 4.10.4 ().
-
WSA-2026-31: [Relay] Bypass of TOTP and denial of service with invalid TOTP received from a relay client.
—
Fixed in version 4.10.4 ().
-
WSA-2026-30: [Xfer] Incoming files and chats auto-accepted from a nick on the wrong server.
—
Fixed in version 4.10.3 ().
-
WSA-2026-29: [Relay] Missing check of the number of hash iterations received from a remote relay.
—
Fixed in version 4.10.3 ().
-
WSA-2026-28: [Xfer] Missing checks of the resume position received in DCC RESUME and DCC ACCEPT.
—
Fixed in version 4.10.3 ().
-
WSA-2026-27: [Relay] Denial of service with huge IRC messages received from a relay client.
—
Fixed in version 4.10.3 ().
-
WSA-2026-26: [IRC] Missing checks in SASL authentication with SCRAM mechanisms.
—
Fixed in version 4.10.3 ().
-
WSA-2026-25: [IRC] Evaluation of untrusted strings received from the IRC server or an IRC URL.
—
Fixed in version 4.10.2 ().
-
WSA-2026-24: [Relay] Missing size limit for HTTP headers received from a client.
—
Fixed in version 4.10.2 ().
-
WSA-2026-23: [Core] Heap buffer overflow in charset conversion.
—
Fixed in version 4.10.2 ().
-
WSA-2026-22: [Relay] Heap buffer overflow in path of hdata sent to clients with "weechat" protocol.
—
Fixed in version 4.10.2 ().
-
WSA-2026-21: [IRC] Heap buffer overflow in nick prefixes after a reconnection.
—
Fixed in version 4.10.2 ().
-
WSA-2026-20: [Relay] Missing size limit of data queued for sending to clients.
—
Fixed in version 4.10.1 ().
-
WSA-2026-19: [Relay] Missing rejection of invalid websocket frames.
—
Fixed in version 4.10.1 ().
-
WSA-2026-18: [Relay] Missing size limit for the unterminated Relay text message received from a client.
—
Fixed in version 4.10.1 ().
-
WSA-2026-17: [Xfer] Bypass of user authorization for start of DCC file transfer.
—
Fixed in version 4.10.1 ().
-
WSA-2026-16: [Xfer] Missing size limit for the unterminated Xfer chat message.
—
Fixed in version 4.10.1 ().
-
WSA-2026-15: [Xfer] Write of DCC file received outside of configured download path.
—
Fixed in version 4.10.1 ().
Affected by 18 vulnerabilities:
-
WSA-2026-32: [Relay] Denial of service with many passwords in command init received from a relay client.
—
Fixed in version 4.10.4 ().
-
WSA-2026-31: [Relay] Bypass of TOTP and denial of service with invalid TOTP received from a relay client.
—
Fixed in version 4.10.4 ().
-
WSA-2026-30: [Xfer] Incoming files and chats auto-accepted from a nick on the wrong server.
—
Fixed in version 4.10.3 ().
-
WSA-2026-29: [Relay] Missing check of the number of hash iterations received from a remote relay.
—
Fixed in version 4.10.3 ().
-
WSA-2026-28: [Xfer] Missing checks of the resume position received in DCC RESUME and DCC ACCEPT.
—
Fixed in version 4.10.3 ().
-
WSA-2026-27: [Relay] Denial of service with huge IRC messages received from a relay client.
—
Fixed in version 4.10.3 ().
-
WSA-2026-26: [IRC] Missing checks in SASL authentication with SCRAM mechanisms.
—
Fixed in version 4.10.3 ().
-
WSA-2026-25: [IRC] Evaluation of untrusted strings received from the IRC server or an IRC URL.
—
Fixed in version 4.10.2 ().
-
WSA-2026-24: [Relay] Missing size limit for HTTP headers received from a client.
—
Fixed in version 4.10.2 ().
-
WSA-2026-23: [Core] Heap buffer overflow in charset conversion.
—
Fixed in version 4.10.2 ().
-
WSA-2026-22: [Relay] Heap buffer overflow in path of hdata sent to clients with "weechat" protocol.
—
Fixed in version 4.10.2 ().
-
WSA-2026-21: [IRC] Heap buffer overflow in nick prefixes after a reconnection.
—
Fixed in version 4.10.2 ().
-
WSA-2026-20: [Relay] Missing size limit of data queued for sending to clients.
—
Fixed in version 4.10.1 ().
-
WSA-2026-19: [Relay] Missing rejection of invalid websocket frames.
—
Fixed in version 4.10.1 ().
-
WSA-2026-18: [Relay] Missing size limit for the unterminated Relay text message received from a client.
—
Fixed in version 4.10.1 ().
-
WSA-2026-17: [Xfer] Bypass of user authorization for start of DCC file transfer.
—
Fixed in version 4.10.1 ().
-
WSA-2026-16: [Xfer] Missing size limit for the unterminated Xfer chat message.
—
Fixed in version 4.10.1 ().
-
WSA-2026-15: [Xfer] Write of DCC file received outside of configured download path.
—
Fixed in version 4.10.1 ().
Affected by 21 vulnerabilities:
-
WSA-2026-32: [Relay] Denial of service with many passwords in command init received from a relay client.
—
Fixed in version 4.10.4 ().
-
WSA-2026-31: [Relay] Bypass of TOTP and denial of service with invalid TOTP received from a relay client.
—
Fixed in version 4.10.4 ().
-
WSA-2026-30: [Xfer] Incoming files and chats auto-accepted from a nick on the wrong server.
—
Fixed in version 4.10.3 ().
-
WSA-2026-29: [Relay] Missing check of the number of hash iterations received from a remote relay.
—
Fixed in version 4.10.3 ().
-
WSA-2026-28: [Xfer] Missing checks of the resume position received in DCC RESUME and DCC ACCEPT.
—
Fixed in version 4.10.3 ().
-
WSA-2026-27: [Relay] Denial of service with huge IRC messages received from a relay client.
—
Fixed in version 4.10.3 ().
-
WSA-2026-26: [IRC] Missing checks in SASL authentication with SCRAM mechanisms.
—
Fixed in version 4.10.3 ().
-
WSA-2026-25: [IRC] Evaluation of untrusted strings received from the IRC server or an IRC URL.
—
Fixed in version 4.10.2 ().
-
WSA-2026-24: [Relay] Missing size limit for HTTP headers received from a client.
—
Fixed in version 4.10.2 ().
-
WSA-2026-23: [Core] Heap buffer overflow in charset conversion.
—
Fixed in version 4.10.2 ().
-
WSA-2026-22: [Relay] Heap buffer overflow in path of hdata sent to clients with "weechat" protocol.
—
Fixed in version 4.10.2 ().
-
WSA-2026-21: [IRC] Heap buffer overflow in nick prefixes after a reconnection.
—
Fixed in version 4.10.2 ().
-
WSA-2026-20: [Relay] Missing size limit of data queued for sending to clients.
—
Fixed in version 4.10.1 ().
-
WSA-2026-19: [Relay] Missing rejection of invalid websocket frames.
—
Fixed in version 4.10.1 ().
-
WSA-2026-18: [Relay] Missing size limit for the unterminated Relay text message received from a client.
—
Fixed in version 4.10.1 ().
-
WSA-2026-17: [Xfer] Bypass of user authorization for start of DCC file transfer.
—
Fixed in version 4.10.1 ().
-
WSA-2026-16: [Xfer] Missing size limit for the unterminated Xfer chat message.
—
Fixed in version 4.10.1 ().
-
WSA-2026-15: [Xfer] Write of DCC file received outside of configured download path.
—
Fixed in version 4.10.1 ().
-
WSA-2026-14: [Relay] Use-after-free and double free when a remote relay sends an event with an array as body.
—
Fixed in version 4.9.5 ().
-
WSA-2026-13: [IRC] Use-after-free in the irc plugin when a batched message disconnects the server.
—
Fixed in version 4.9.5 ().
-
WSA-2026-12: [IRC] Stack buffer overflow when building a JOIN command with channel keys.
—
Fixed in version 4.9.5 ().
Affected by 23 vulnerabilities:
-
WSA-2026-32: [Relay] Denial of service with many passwords in command init received from a relay client.
—
Fixed in version 4.10.4 ().
-
WSA-2026-31: [Relay] Bypass of TOTP and denial of service with invalid TOTP received from a relay client.
—
Fixed in version 4.10.4 ().
-
WSA-2026-30: [Xfer] Incoming files and chats auto-accepted from a nick on the wrong server.
—
Fixed in version 4.10.3 ().
-
WSA-2026-29: [Relay] Missing check of the number of hash iterations received from a remote relay.
—
Fixed in version 4.10.3 ().
-
WSA-2026-28: [Xfer] Missing checks of the resume position received in DCC RESUME and DCC ACCEPT.
—
Fixed in version 4.10.3 ().
-
WSA-2026-27: [Relay] Denial of service with huge IRC messages received from a relay client.
—
Fixed in version 4.10.3 ().
-
WSA-2026-26: [IRC] Missing checks in SASL authentication with SCRAM mechanisms.
—
Fixed in version 4.10.3 ().
-
WSA-2026-25: [IRC] Evaluation of untrusted strings received from the IRC server or an IRC URL.
—
Fixed in version 4.10.2 ().
-
WSA-2026-24: [Relay] Missing size limit for HTTP headers received from a client.
—
Fixed in version 4.10.2 ().
-
WSA-2026-23: [Core] Heap buffer overflow in charset conversion.
—
Fixed in version 4.10.2 ().
-
WSA-2026-22: [Relay] Heap buffer overflow in path of hdata sent to clients with "weechat" protocol.
—
Fixed in version 4.10.2 ().
-
WSA-2026-21: [IRC] Heap buffer overflow in nick prefixes after a reconnection.
—
Fixed in version 4.10.2 ().
-
WSA-2026-20: [Relay] Missing size limit of data queued for sending to clients.
—
Fixed in version 4.10.1 ().
-
WSA-2026-19: [Relay] Missing rejection of invalid websocket frames.
—
Fixed in version 4.10.1 ().
-
WSA-2026-18: [Relay] Missing size limit for the unterminated Relay text message received from a client.
—
Fixed in version 4.10.1 ().
-
WSA-2026-17: [Xfer] Bypass of user authorization for start of DCC file transfer.
—
Fixed in version 4.10.1 ().
-
WSA-2026-16: [Xfer] Missing size limit for the unterminated Xfer chat message.
—
Fixed in version 4.10.1 ().
-
WSA-2026-15: [Xfer] Write of DCC file received outside of configured download path.
—
Fixed in version 4.10.1 ().
-
WSA-2026-14: [Relay] Use-after-free and double free when a remote relay sends an event with an array as body.
—
Fixed in version 4.9.5 ().
-
WSA-2026-13: [IRC] Use-after-free in the irc plugin when a batched message disconnects the server.
—
Fixed in version 4.9.5 ().
-
WSA-2026-12: [IRC] Stack buffer overflow when building a JOIN command with channel keys.
—
Fixed in version 4.9.5 ().
-
WSA-2026-11: [Logger] Write of logger file outside of configured path.
—
Fixed in version 4.9.4 ().
-
WSA-2026-10: [Relay] Authentication bypass in Relay plugin, protocols "api" and "weechat".
—
Fixed in version 4.9.4 ().
Affected by 24 vulnerabilities:
-
WSA-2026-32: [Relay] Denial of service with many passwords in command init received from a relay client.
—
Fixed in version 4.10.4 ().
-
WSA-2026-31: [Relay] Bypass of TOTP and denial of service with invalid TOTP received from a relay client.
—
Fixed in version 4.10.4 ().
-
WSA-2026-30: [Xfer] Incoming files and chats auto-accepted from a nick on the wrong server.
—
Fixed in version 4.10.3 ().
-
WSA-2026-29: [Relay] Missing check of the number of hash iterations received from a remote relay.
—
Fixed in version 4.10.3 ().
-
WSA-2026-28: [Xfer] Missing checks of the resume position received in DCC RESUME and DCC ACCEPT.
—
Fixed in version 4.10.3 ().
-
WSA-2026-27: [Relay] Denial of service with huge IRC messages received from a relay client.
—
Fixed in version 4.10.3 ().
-
WSA-2026-26: [IRC] Missing checks in SASL authentication with SCRAM mechanisms.
—
Fixed in version 4.10.3 ().
-
WSA-2026-25: [IRC] Evaluation of untrusted strings received from the IRC server or an IRC URL.
—
Fixed in version 4.10.2 ().
-
WSA-2026-24: [Relay] Missing size limit for HTTP headers received from a client.
—
Fixed in version 4.10.2 ().
-
WSA-2026-23: [Core] Heap buffer overflow in charset conversion.
—
Fixed in version 4.10.2 ().
-
WSA-2026-22: [Relay] Heap buffer overflow in path of hdata sent to clients with "weechat" protocol.
—
Fixed in version 4.10.2 ().
-
WSA-2026-21: [IRC] Heap buffer overflow in nick prefixes after a reconnection.
—
Fixed in version 4.10.2 ().
-
WSA-2026-20: [Relay] Missing size limit of data queued for sending to clients.
—
Fixed in version 4.10.1 ().
-
WSA-2026-19: [Relay] Missing rejection of invalid websocket frames.
—
Fixed in version 4.10.1 ().
-
WSA-2026-18: [Relay] Missing size limit for the unterminated Relay text message received from a client.
—
Fixed in version 4.10.1 ().
-
WSA-2026-17: [Xfer] Bypass of user authorization for start of DCC file transfer.
—
Fixed in version 4.10.1 ().
-
WSA-2026-16: [Xfer] Missing size limit for the unterminated Xfer chat message.
—
Fixed in version 4.10.1 ().
-
WSA-2026-15: [Xfer] Write of DCC file received outside of configured download path.
—
Fixed in version 4.10.1 ().
-
WSA-2026-14: [Relay] Use-after-free and double free when a remote relay sends an event with an array as body.
—
Fixed in version 4.9.5 ().
-
WSA-2026-13: [IRC] Use-after-free in the irc plugin when a batched message disconnects the server.
—
Fixed in version 4.9.5 ().
-
WSA-2026-12: [IRC] Stack buffer overflow when building a JOIN command with channel keys.
—
Fixed in version 4.9.5 ().
-
WSA-2026-11: [Logger] Write of logger file outside of configured path.
—
Fixed in version 4.9.4 ().
-
WSA-2026-10: [Relay] Authentication bypass in Relay plugin, protocols "api" and "weechat".
—
Fixed in version 4.9.4 ().
-
WSA-2026-9: [Relay] Memory leak in API relay, endpoint "handshake".
—
Fixed in version 4.9.3 ().
Affected by 30 vulnerabilities:
-
WSA-2026-32: [Relay] Denial of service with many passwords in command init received from a relay client.
—
Fixed in version 4.10.4 ().
-
WSA-2026-31: [Relay] Bypass of TOTP and denial of service with invalid TOTP received from a relay client.
—
Fixed in version 4.10.4 ().
-
WSA-2026-30: [Xfer] Incoming files and chats auto-accepted from a nick on the wrong server.
—
Fixed in version 4.10.3 ().
-
WSA-2026-29: [Relay] Missing check of the number of hash iterations received from a remote relay.
—
Fixed in version 4.10.3 ().
-
WSA-2026-28: [Xfer] Missing checks of the resume position received in DCC RESUME and DCC ACCEPT.
—
Fixed in version 4.10.3 ().
-
WSA-2026-27: [Relay] Denial of service with huge IRC messages received from a relay client.
—
Fixed in version 4.10.3 ().
-
WSA-2026-26: [IRC] Missing checks in SASL authentication with SCRAM mechanisms.
—
Fixed in version 4.10.3 ().
-
WSA-2026-25: [IRC] Evaluation of untrusted strings received from the IRC server or an IRC URL.
—
Fixed in version 4.10.2 ().
-
WSA-2026-24: [Relay] Missing size limit for HTTP headers received from a client.
—
Fixed in version 4.10.2 ().
-
WSA-2026-23: [Core] Heap buffer overflow in charset conversion.
—
Fixed in version 4.10.2 ().
-
WSA-2026-22: [Relay] Heap buffer overflow in path of hdata sent to clients with "weechat" protocol.
—
Fixed in version 4.10.2 ().
-
WSA-2026-21: [IRC] Heap buffer overflow in nick prefixes after a reconnection.
—
Fixed in version 4.10.2 ().
-
WSA-2026-20: [Relay] Missing size limit of data queued for sending to clients.
—
Fixed in version 4.10.1 ().
-
WSA-2026-19: [Relay] Missing rejection of invalid websocket frames.
—
Fixed in version 4.10.1 ().
-
WSA-2026-18: [Relay] Missing size limit for the unterminated Relay text message received from a client.
—
Fixed in version 4.10.1 ().
-
WSA-2026-17: [Xfer] Bypass of user authorization for start of DCC file transfer.
—
Fixed in version 4.10.1 ().
-
WSA-2026-16: [Xfer] Missing size limit for the unterminated Xfer chat message.
—
Fixed in version 4.10.1 ().
-
WSA-2026-15: [Xfer] Write of DCC file received outside of configured download path.
—
Fixed in version 4.10.1 ().
-
WSA-2026-14: [Relay] Use-after-free and double free when a remote relay sends an event with an array as body.
—
Fixed in version 4.9.5 ().
-
WSA-2026-13: [IRC] Use-after-free in the irc plugin when a batched message disconnects the server.
—
Fixed in version 4.9.5 ().
-
WSA-2026-12: [IRC] Stack buffer overflow when building a JOIN command with channel keys.
—
Fixed in version 4.9.5 ().
-
WSA-2026-11: [Logger] Write of logger file outside of configured path.
—
Fixed in version 4.9.4 ().
-
WSA-2026-10: [Relay] Authentication bypass in Relay plugin, protocols "api" and "weechat".
—
Fixed in version 4.9.4 ().
-
WSA-2026-9: [Relay] Memory leak in API relay, endpoint "handshake".
—
Fixed in version 4.9.3 ().
-
WSA-2026-8: [Relay] Buffer overflow in dump of Relay data.
—
Fixed in version 4.9.2 ().
-
WSA-2026-7: [Xfer] Buffer overflow when receiving a line in a Xfer chat (DCC chat) buffer.
—
Fixed in version 4.9.2 ().
-
WSA-2026-6: [Xfer] Write of DCC file received outside of configured download path.
—
Fixed in version 4.9.2 ().
-
WSA-2026-5: [IRC] Buffer overflow when receiving a DCC file.
—
Fixed in version 4.9.2 ().
-
WSA-2026-4: [Relay] Missing size limit for the received websocket frame, HTTP message and HTTP body.
—
Fixed in version 4.9.2 ().
-
WSA-2026-3: [IRC] Missing size limit for the unterminated IRC message or isupport value (message 005).
—
Fixed in version 4.9.2 ().
Affected by 32 vulnerabilities:
-
WSA-2026-32: [Relay] Denial of service with many passwords in command init received from a relay client.
—
Fixed in version 4.10.4 ().
-
WSA-2026-31: [Relay] Bypass of TOTP and denial of service with invalid TOTP received from a relay client.
—
Fixed in version 4.10.4 ().
-
WSA-2026-30: [Xfer] Incoming files and chats auto-accepted from a nick on the wrong server.
—
Fixed in version 4.10.3 ().
-
WSA-2026-29: [Relay] Missing check of the number of hash iterations received from a remote relay.
—
Fixed in version 4.10.3 ().
-
WSA-2026-28: [Xfer] Missing checks of the resume position received in DCC RESUME and DCC ACCEPT.
—
Fixed in version 4.10.3 ().
-
WSA-2026-27: [Relay] Denial of service with huge IRC messages received from a relay client.
—
Fixed in version 4.10.3 ().
-
WSA-2026-26: [IRC] Missing checks in SASL authentication with SCRAM mechanisms.
—
Fixed in version 4.10.3 ().
-
WSA-2026-25: [IRC] Evaluation of untrusted strings received from the IRC server or an IRC URL.
—
Fixed in version 4.10.2 ().
-
WSA-2026-24: [Relay] Missing size limit for HTTP headers received from a client.
—
Fixed in version 4.10.2 ().
-
WSA-2026-23: [Core] Heap buffer overflow in charset conversion.
—
Fixed in version 4.10.2 ().
-
WSA-2026-22: [Relay] Heap buffer overflow in path of hdata sent to clients with "weechat" protocol.
—
Fixed in version 4.10.2 ().
-
WSA-2026-21: [IRC] Heap buffer overflow in nick prefixes after a reconnection.
—
Fixed in version 4.10.2 ().
-
WSA-2026-20: [Relay] Missing size limit of data queued for sending to clients.
—
Fixed in version 4.10.1 ().
-
WSA-2026-19: [Relay] Missing rejection of invalid websocket frames.
—
Fixed in version 4.10.1 ().
-
WSA-2026-18: [Relay] Missing size limit for the unterminated Relay text message received from a client.
—
Fixed in version 4.10.1 ().
-
WSA-2026-17: [Xfer] Bypass of user authorization for start of DCC file transfer.
—
Fixed in version 4.10.1 ().
-
WSA-2026-16: [Xfer] Missing size limit for the unterminated Xfer chat message.
—
Fixed in version 4.10.1 ().
-
WSA-2026-15: [Xfer] Write of DCC file received outside of configured download path.
—
Fixed in version 4.10.1 ().
-
WSA-2026-14: [Relay] Use-after-free and double free when a remote relay sends an event with an array as body.
—
Fixed in version 4.9.5 ().
-
WSA-2026-13: [IRC] Use-after-free in the irc plugin when a batched message disconnects the server.
—
Fixed in version 4.9.5 ().
-
WSA-2026-12: [IRC] Stack buffer overflow when building a JOIN command with channel keys.
—
Fixed in version 4.9.5 ().
-
WSA-2026-11: [Logger] Write of logger file outside of configured path.
—
Fixed in version 4.9.4 ().
-
WSA-2026-10: [Relay] Authentication bypass in Relay plugin, protocols "api" and "weechat".
—
Fixed in version 4.9.4 ().
-
WSA-2026-9: [Relay] Memory leak in API relay, endpoint "handshake".
—
Fixed in version 4.9.3 ().
-
WSA-2026-8: [Relay] Buffer overflow in dump of Relay data.
—
Fixed in version 4.9.2 ().
-
WSA-2026-7: [Xfer] Buffer overflow when receiving a line in a Xfer chat (DCC chat) buffer.
—
Fixed in version 4.9.2 ().
-
WSA-2026-6: [Xfer] Write of DCC file received outside of configured download path.
—
Fixed in version 4.9.2 ().
-
WSA-2026-5: [IRC] Buffer overflow when receiving a DCC file.
—
Fixed in version 4.9.2 ().
-
WSA-2026-4: [Relay] Missing size limit for the received websocket frame, HTTP message and HTTP body.
—
Fixed in version 4.9.2 ().
-
WSA-2026-3: [IRC] Missing size limit for the unterminated IRC message or isupport value (message 005).
—
Fixed in version 4.9.2 ().
-
WSA-2026-2: [API, Relay] Non-constant time password/hash comparison.
—
Fixed in version 4.9.1 ().
-
WSA-2026-1: [Relay] Missing size limit for the decompressed websocket frame in relay plugin, protocol "api".
—
Fixed in version 4.9.1 ().
Affected by 32 vulnerabilities:
-
WSA-2026-32: [Relay] Denial of service with many passwords in command init received from a relay client.
—
Fixed in version 4.10.4 ().
-
WSA-2026-31: [Relay] Bypass of TOTP and denial of service with invalid TOTP received from a relay client.
—
Fixed in version 4.10.4 ().
-
WSA-2026-30: [Xfer] Incoming files and chats auto-accepted from a nick on the wrong server.
—
Fixed in version 4.10.3 ().
-
WSA-2026-29: [Relay] Missing check of the number of hash iterations received from a remote relay.
—
Fixed in version 4.10.3 ().
-
WSA-2026-28: [Xfer] Missing checks of the resume position received in DCC RESUME and DCC ACCEPT.
—
Fixed in version 4.10.3 ().
-
WSA-2026-27: [Relay] Denial of service with huge IRC messages received from a relay client.
—
Fixed in version 4.10.3 ().
-
WSA-2026-26: [IRC] Missing checks in SASL authentication with SCRAM mechanisms.
—
Fixed in version 4.10.3 ().
-
WSA-2026-25: [IRC] Evaluation of untrusted strings received from the IRC server or an IRC URL.
—
Fixed in version 4.10.2 ().
-
WSA-2026-24: [Relay] Missing size limit for HTTP headers received from a client.
—
Fixed in version 4.10.2 ().
-
WSA-2026-23: [Core] Heap buffer overflow in charset conversion.
—
Fixed in version 4.10.2 ().
-
WSA-2026-22: [Relay] Heap buffer overflow in path of hdata sent to clients with "weechat" protocol.
—
Fixed in version 4.10.2 ().
-
WSA-2026-21: [IRC] Heap buffer overflow in nick prefixes after a reconnection.
—
Fixed in version 4.10.2 ().
-
WSA-2026-20: [Relay] Missing size limit of data queued for sending to clients.
—
Fixed in version 4.10.1 ().
-
WSA-2026-19: [Relay] Missing rejection of invalid websocket frames.
—
Fixed in version 4.10.1 ().
-
WSA-2026-18: [Relay] Missing size limit for the unterminated Relay text message received from a client.
—
Fixed in version 4.10.1 ().
-
WSA-2026-17: [Xfer] Bypass of user authorization for start of DCC file transfer.
—
Fixed in version 4.10.1 ().
-
WSA-2026-16: [Xfer] Missing size limit for the unterminated Xfer chat message.
—
Fixed in version 4.10.1 ().
-
WSA-2026-15: [Xfer] Write of DCC file received outside of configured download path.
—
Fixed in version 4.10.1 ().
-
WSA-2026-14: [Relay] Use-after-free and double free when a remote relay sends an event with an array as body.
—
Fixed in version 4.9.5 ().
-
WSA-2026-13: [IRC] Use-after-free in the irc plugin when a batched message disconnects the server.
—
Fixed in version 4.9.5 ().
-
WSA-2026-12: [IRC] Stack buffer overflow when building a JOIN command with channel keys.
—
Fixed in version 4.9.5 ().
-
WSA-2026-11: [Logger] Write of logger file outside of configured path.
—
Fixed in version 4.9.4 ().
-
WSA-2026-10: [Relay] Authentication bypass in Relay plugin, protocols "api" and "weechat".
—
Fixed in version 4.9.4 ().
-
WSA-2026-9: [Relay] Memory leak in API relay, endpoint "handshake".
—
Fixed in version 4.9.3 ().
-
WSA-2026-8: [Relay] Buffer overflow in dump of Relay data.
—
Fixed in version 4.9.2 ().
-
WSA-2026-7: [Xfer] Buffer overflow when receiving a line in a Xfer chat (DCC chat) buffer.
—
Fixed in version 4.9.2 ().
-
WSA-2026-6: [Xfer] Write of DCC file received outside of configured download path.
—
Fixed in version 4.9.2 ().
-
WSA-2026-5: [IRC] Buffer overflow when receiving a DCC file.
—
Fixed in version 4.9.2 ().
-
WSA-2026-4: [Relay] Missing size limit for the received websocket frame, HTTP message and HTTP body.
—
Fixed in version 4.9.2 ().
-
WSA-2026-3: [IRC] Missing size limit for the unterminated IRC message or isupport value (message 005).
—
Fixed in version 4.9.2 ().
-
WSA-2026-2: [API, Relay] Non-constant time password/hash comparison.
—
Fixed in version 4.9.1 ().
-
WSA-2026-1: [Relay] Missing size limit for the decompressed websocket frame in relay plugin, protocol "api".
—
Fixed in version 4.9.1 ().
Affected by 32 vulnerabilities:
-
WSA-2026-32: [Relay] Denial of service with many passwords in command init received from a relay client.
—
Fixed in version 4.10.4 ().
-
WSA-2026-31: [Relay] Bypass of TOTP and denial of service with invalid TOTP received from a relay client.
—
Fixed in version 4.10.4 ().
-
WSA-2026-30: [Xfer] Incoming files and chats auto-accepted from a nick on the wrong server.
—
Fixed in version 4.10.3 ().
-
WSA-2026-29: [Relay] Missing check of the number of hash iterations received from a remote relay.
—
Fixed in version 4.10.3 ().
-
WSA-2026-28: [Xfer] Missing checks of the resume position received in DCC RESUME and DCC ACCEPT.
—
Fixed in version 4.10.3 ().
-
WSA-2026-27: [Relay] Denial of service with huge IRC messages received from a relay client.
—
Fixed in version 4.10.3 ().
-
WSA-2026-26: [IRC] Missing checks in SASL authentication with SCRAM mechanisms.
—
Fixed in version 4.10.3 ().
-
WSA-2026-25: [IRC] Evaluation of untrusted strings received from the IRC server or an IRC URL.
—
Fixed in version 4.10.2 ().
-
WSA-2026-24: [Relay] Missing size limit for HTTP headers received from a client.
—
Fixed in version 4.10.2 ().
-
WSA-2026-23: [Core] Heap buffer overflow in charset conversion.
—
Fixed in version 4.10.2 ().
-
WSA-2026-22: [Relay] Heap buffer overflow in path of hdata sent to clients with "weechat" protocol.
—
Fixed in version 4.10.2 ().
-
WSA-2026-21: [IRC] Heap buffer overflow in nick prefixes after a reconnection.
—
Fixed in version 4.10.2 ().
-
WSA-2026-20: [Relay] Missing size limit of data queued for sending to clients.
—
Fixed in version 4.10.1 ().
-
WSA-2026-19: [Relay] Missing rejection of invalid websocket frames.
—
Fixed in version 4.10.1 ().
-
WSA-2026-18: [Relay] Missing size limit for the unterminated Relay text message received from a client.
—
Fixed in version 4.10.1 ().
-
WSA-2026-17: [Xfer] Bypass of user authorization for start of DCC file transfer.
—
Fixed in version 4.10.1 ().
-
WSA-2026-16: [Xfer] Missing size limit for the unterminated Xfer chat message.
—
Fixed in version 4.10.1 ().
-
WSA-2026-15: [Xfer] Write of DCC file received outside of configured download path.
—
Fixed in version 4.10.1 ().
-
WSA-2026-14: [Relay] Use-after-free and double free when a remote relay sends an event with an array as body.
—
Fixed in version 4.9.5 ().
-
WSA-2026-13: [IRC] Use-after-free in the irc plugin when a batched message disconnects the server.
—
Fixed in version 4.9.5 ().
-
WSA-2026-12: [IRC] Stack buffer overflow when building a JOIN command with channel keys.
—
Fixed in version 4.9.5 ().
-
WSA-2026-11: [Logger] Write of logger file outside of configured path.
—
Fixed in version 4.9.4 ().
-
WSA-2026-10: [Relay] Authentication bypass in Relay plugin, protocols "api" and "weechat".
—
Fixed in version 4.9.4 ().
-
WSA-2026-9: [Relay] Memory leak in API relay, endpoint "handshake".
—
Fixed in version 4.9.3 ().
-
WSA-2026-8: [Relay] Buffer overflow in dump of Relay data.
—
Fixed in version 4.9.2 ().
-
WSA-2026-7: [Xfer] Buffer overflow when receiving a line in a Xfer chat (DCC chat) buffer.
—
Fixed in version 4.9.2 ().
-
WSA-2026-6: [Xfer] Write of DCC file received outside of configured download path.
—
Fixed in version 4.9.2 ().
-
WSA-2026-5: [IRC] Buffer overflow when receiving a DCC file.
—
Fixed in version 4.9.2 ().
-
WSA-2026-4: [Relay] Missing size limit for the received websocket frame, HTTP message and HTTP body.
—
Fixed in version 4.9.2 ().
-
WSA-2026-3: [IRC] Missing size limit for the unterminated IRC message or isupport value (message 005).
—
Fixed in version 4.9.2 ().
-
WSA-2026-2: [API, Relay] Non-constant time password/hash comparison.
—
Fixed in version 4.9.1 ().
-
WSA-2026-1: [Relay] Missing size limit for the decompressed websocket frame in relay plugin, protocol "api".
—
Fixed in version 4.9.1 ().
Affected by 32 vulnerabilities:
-
WSA-2026-32: [Relay] Denial of service with many passwords in command init received from a relay client.
—
Fixed in version 4.10.4 ().
-
WSA-2026-31: [Relay] Bypass of TOTP and denial of service with invalid TOTP received from a relay client.
—
Fixed in version 4.10.4 ().
-
WSA-2026-30: [Xfer] Incoming files and chats auto-accepted from a nick on the wrong server.
—
Fixed in version 4.10.3 ().
-
WSA-2026-29: [Relay] Missing check of the number of hash iterations received from a remote relay.
—
Fixed in version 4.10.3 ().
-
WSA-2026-28: [Xfer] Missing checks of the resume position received in DCC RESUME and DCC ACCEPT.
—
Fixed in version 4.10.3 ().
-
WSA-2026-27: [Relay] Denial of service with huge IRC messages received from a relay client.
—
Fixed in version 4.10.3 ().
-
WSA-2026-26: [IRC] Missing checks in SASL authentication with SCRAM mechanisms.
—
Fixed in version 4.10.3 ().
-
WSA-2026-25: [IRC] Evaluation of untrusted strings received from the IRC server or an IRC URL.
—
Fixed in version 4.10.2 ().
-
WSA-2026-24: [Relay] Missing size limit for HTTP headers received from a client.
—
Fixed in version 4.10.2 ().
-
WSA-2026-23: [Core] Heap buffer overflow in charset conversion.
—
Fixed in version 4.10.2 ().
-
WSA-2026-22: [Relay] Heap buffer overflow in path of hdata sent to clients with "weechat" protocol.
—
Fixed in version 4.10.2 ().
-
WSA-2026-21: [IRC] Heap buffer overflow in nick prefixes after a reconnection.
—
Fixed in version 4.10.2 ().
-
WSA-2026-20: [Relay] Missing size limit of data queued for sending to clients.
—
Fixed in version 4.10.1 ().
-
WSA-2026-19: [Relay] Missing rejection of invalid websocket frames.
—
Fixed in version 4.10.1 ().
-
WSA-2026-18: [Relay] Missing size limit for the unterminated Relay text message received from a client.
—
Fixed in version 4.10.1 ().
-
WSA-2026-17: [Xfer] Bypass of user authorization for start of DCC file transfer.
—
Fixed in version 4.10.1 ().
-
WSA-2026-16: [Xfer] Missing size limit for the unterminated Xfer chat message.
—
Fixed in version 4.10.1 ().
-
WSA-2026-15: [Xfer] Write of DCC file received outside of configured download path.
—
Fixed in version 4.10.1 ().
-
WSA-2026-14: [Relay] Use-after-free and double free when a remote relay sends an event with an array as body.
—
Fixed in version 4.9.5 ().
-
WSA-2026-13: [IRC] Use-after-free in the irc plugin when a batched message disconnects the server.
—
Fixed in version 4.9.5 ().
-
WSA-2026-12: [IRC] Stack buffer overflow when building a JOIN command with channel keys.
—
Fixed in version 4.9.5 ().
-
WSA-2026-11: [Logger] Write of logger file outside of configured path.
—
Fixed in version 4.9.4 ().
-
WSA-2026-10: [Relay] Authentication bypass in Relay plugin, protocols "api" and "weechat".
—
Fixed in version 4.9.4 ().
-
WSA-2026-9: [Relay] Memory leak in API relay, endpoint "handshake".
—
Fixed in version 4.9.3 ().
-
WSA-2026-8: [Relay] Buffer overflow in dump of Relay data.
—
Fixed in version 4.9.2 ().
-
WSA-2026-7: [Xfer] Buffer overflow when receiving a line in a Xfer chat (DCC chat) buffer.
—
Fixed in version 4.9.2 ().
-
WSA-2026-6: [Xfer] Write of DCC file received outside of configured download path.
—
Fixed in version 4.9.2 ().
-
WSA-2026-5: [IRC] Buffer overflow when receiving a DCC file.
—
Fixed in version 4.9.2 ().
-
WSA-2026-4: [Relay] Missing size limit for the received websocket frame, HTTP message and HTTP body.
—
Fixed in version 4.9.2 ().
-
WSA-2026-3: [IRC] Missing size limit for the unterminated IRC message or isupport value (message 005).
—
Fixed in version 4.9.2 ().
-
WSA-2026-2: [API, Relay] Non-constant time password/hash comparison.
—
Fixed in version 4.9.1 ().
-
WSA-2026-1: [Relay] Missing size limit for the decompressed websocket frame in relay plugin, protocol "api".
—
Fixed in version 4.9.1 ().
Affected by 32 vulnerabilities:
-
WSA-2026-32: [Relay] Denial of service with many passwords in command init received from a relay client.
—
Fixed in version 4.10.4 ().
-
WSA-2026-31: [Relay] Bypass of TOTP and denial of service with invalid TOTP received from a relay client.
—
Fixed in version 4.10.4 ().
-
WSA-2026-30: [Xfer] Incoming files and chats auto-accepted from a nick on the wrong server.
—
Fixed in version 4.10.3 ().
-
WSA-2026-29: [Relay] Missing check of the number of hash iterations received from a remote relay.
—
Fixed in version 4.10.3 ().
-
WSA-2026-28: [Xfer] Missing checks of the resume position received in DCC RESUME and DCC ACCEPT.
—
Fixed in version 4.10.3 ().
-
WSA-2026-27: [Relay] Denial of service with huge IRC messages received from a relay client.
—
Fixed in version 4.10.3 ().
-
WSA-2026-26: [IRC] Missing checks in SASL authentication with SCRAM mechanisms.
—
Fixed in version 4.10.3 ().
-
WSA-2026-25: [IRC] Evaluation of untrusted strings received from the IRC server or an IRC URL.
—
Fixed in version 4.10.2 ().
-
WSA-2026-24: [Relay] Missing size limit for HTTP headers received from a client.
—
Fixed in version 4.10.2 ().
-
WSA-2026-23: [Core] Heap buffer overflow in charset conversion.
—
Fixed in version 4.10.2 ().
-
WSA-2026-22: [Relay] Heap buffer overflow in path of hdata sent to clients with "weechat" protocol.
—
Fixed in version 4.10.2 ().
-
WSA-2026-21: [IRC] Heap buffer overflow in nick prefixes after a reconnection.
—
Fixed in version 4.10.2 ().
-
WSA-2026-20: [Relay] Missing size limit of data queued for sending to clients.
—
Fixed in version 4.10.1 ().
-
WSA-2026-19: [Relay] Missing rejection of invalid websocket frames.
—
Fixed in version 4.10.1 ().
-
WSA-2026-18: [Relay] Missing size limit for the unterminated Relay text message received from a client.
—
Fixed in version 4.10.1 ().
-
WSA-2026-17: [Xfer] Bypass of user authorization for start of DCC file transfer.
—
Fixed in version 4.10.1 ().
-
WSA-2026-16: [Xfer] Missing size limit for the unterminated Xfer chat message.
—
Fixed in version 4.10.1 ().
-
WSA-2026-15: [Xfer] Write of DCC file received outside of configured download path.
—
Fixed in version 4.10.1 ().
-
WSA-2026-14: [Relay] Use-after-free and double free when a remote relay sends an event with an array as body.
—
Fixed in version 4.9.5 ().
-
WSA-2026-13: [IRC] Use-after-free in the irc plugin when a batched message disconnects the server.
—
Fixed in version 4.9.5 ().
-
WSA-2026-12: [IRC] Stack buffer overflow when building a JOIN command with channel keys.
—
Fixed in version 4.9.5 ().
-
WSA-2026-11: [Logger] Write of logger file outside of configured path.
—
Fixed in version 4.9.4 ().
-
WSA-2026-10: [Relay] Authentication bypass in Relay plugin, protocols "api" and "weechat".
—
Fixed in version 4.9.4 ().
-
WSA-2026-9: [Relay] Memory leak in API relay, endpoint "handshake".
—
Fixed in version 4.9.3 ().
-
WSA-2026-8: [Relay] Buffer overflow in dump of Relay data.
—
Fixed in version 4.9.2 ().
-
WSA-2026-7: [Xfer] Buffer overflow when receiving a line in a Xfer chat (DCC chat) buffer.
—
Fixed in version 4.9.2 ().
-
WSA-2026-6: [Xfer] Write of DCC file received outside of configured download path.
—
Fixed in version 4.9.2 ().
-
WSA-2026-5: [IRC] Buffer overflow when receiving a DCC file.
—
Fixed in version 4.9.2 ().
-
WSA-2026-4: [Relay] Missing size limit for the received websocket frame, HTTP message and HTTP body.
—
Fixed in version 4.9.2 ().
-
WSA-2026-3: [IRC] Missing size limit for the unterminated IRC message or isupport value (message 005).
—
Fixed in version 4.9.2 ().
-
WSA-2026-2: [API, Relay] Non-constant time password/hash comparison.
—
Fixed in version 4.9.1 ().
-
WSA-2026-1: [Relay] Missing size limit for the decompressed websocket frame in relay plugin, protocol "api".
—
Fixed in version 4.9.1 ().
Affected by 32 vulnerabilities:
-
WSA-2026-32: [Relay] Denial of service with many passwords in command init received from a relay client.
—
Fixed in version 4.10.4 ().
-
WSA-2026-31: [Relay] Bypass of TOTP and denial of service with invalid TOTP received from a relay client.
—
Fixed in version 4.10.4 ().
-
WSA-2026-30: [Xfer] Incoming files and chats auto-accepted from a nick on the wrong server.
—
Fixed in version 4.10.3 ().
-
WSA-2026-29: [Relay] Missing check of the number of hash iterations received from a remote relay.
—
Fixed in version 4.10.3 ().
-
WSA-2026-28: [Xfer] Missing checks of the resume position received in DCC RESUME and DCC ACCEPT.
—
Fixed in version 4.10.3 ().
-
WSA-2026-27: [Relay] Denial of service with huge IRC messages received from a relay client.
—
Fixed in version 4.10.3 ().
-
WSA-2026-26: [IRC] Missing checks in SASL authentication with SCRAM mechanisms.
—
Fixed in version 4.10.3 ().
-
WSA-2026-25: [IRC] Evaluation of untrusted strings received from the IRC server or an IRC URL.
—
Fixed in version 4.10.2 ().
-
WSA-2026-24: [Relay] Missing size limit for HTTP headers received from a client.
—
Fixed in version 4.10.2 ().
-
WSA-2026-23: [Core] Heap buffer overflow in charset conversion.
—
Fixed in version 4.10.2 ().
-
WSA-2026-22: [Relay] Heap buffer overflow in path of hdata sent to clients with "weechat" protocol.
—
Fixed in version 4.10.2 ().
-
WSA-2026-21: [IRC] Heap buffer overflow in nick prefixes after a reconnection.
—
Fixed in version 4.10.2 ().
-
WSA-2026-20: [Relay] Missing size limit of data queued for sending to clients.
—
Fixed in version 4.10.1 ().
-
WSA-2026-19: [Relay] Missing rejection of invalid websocket frames.
—
Fixed in version 4.10.1 ().
-
WSA-2026-18: [Relay] Missing size limit for the unterminated Relay text message received from a client.
—
Fixed in version 4.10.1 ().
-
WSA-2026-17: [Xfer] Bypass of user authorization for start of DCC file transfer.
—
Fixed in version 4.10.1 ().
-
WSA-2026-16: [Xfer] Missing size limit for the unterminated Xfer chat message.
—
Fixed in version 4.10.1 ().
-
WSA-2026-15: [Xfer] Write of DCC file received outside of configured download path.
—
Fixed in version 4.10.1 ().
-
WSA-2026-14: [Relay] Use-after-free and double free when a remote relay sends an event with an array as body.
—
Fixed in version 4.9.5 ().
-
WSA-2026-13: [IRC] Use-after-free in the irc plugin when a batched message disconnects the server.
—
Fixed in version 4.9.5 ().
-
WSA-2026-12: [IRC] Stack buffer overflow when building a JOIN command with channel keys.
—
Fixed in version 4.9.5 ().
-
WSA-2026-11: [Logger] Write of logger file outside of configured path.
—
Fixed in version 4.9.4 ().
-
WSA-2026-10: [Relay] Authentication bypass in Relay plugin, protocols "api" and "weechat".
—
Fixed in version 4.9.4 ().
-
WSA-2026-9: [Relay] Memory leak in API relay, endpoint "handshake".
—
Fixed in version 4.9.3 ().
-
WSA-2026-8: [Relay] Buffer overflow in dump of Relay data.
—
Fixed in version 4.9.2 ().
-
WSA-2026-7: [Xfer] Buffer overflow when receiving a line in a Xfer chat (DCC chat) buffer.
—
Fixed in version 4.9.2 ().
-
WSA-2026-6: [Xfer] Write of DCC file received outside of configured download path.
—
Fixed in version 4.9.2 ().
-
WSA-2026-5: [IRC] Buffer overflow when receiving a DCC file.
—
Fixed in version 4.9.2 ().
-
WSA-2026-4: [Relay] Missing size limit for the received websocket frame, HTTP message and HTTP body.
—
Fixed in version 4.9.2 ().
-
WSA-2026-3: [IRC] Missing size limit for the unterminated IRC message or isupport value (message 005).
—
Fixed in version 4.9.2 ().
-
WSA-2026-2: [API, Relay] Non-constant time password/hash comparison.
—
Fixed in version 4.9.1 ().
-
WSA-2026-1: [Relay] Missing size limit for the decompressed websocket frame in relay plugin, protocol "api".
—
Fixed in version 4.9.1 ().
Affected by 33 vulnerabilities:
-
WSA-2026-32: [Relay] Denial of service with many passwords in command init received from a relay client.
—
Fixed in version 4.10.4 ().
-
WSA-2026-31: [Relay] Bypass of TOTP and denial of service with invalid TOTP received from a relay client.
—
Fixed in version 4.10.4 ().
-
WSA-2026-30: [Xfer] Incoming files and chats auto-accepted from a nick on the wrong server.
—
Fixed in version 4.10.3 ().
-
WSA-2026-29: [Relay] Missing check of the number of hash iterations received from a remote relay.
—
Fixed in version 4.10.3 ().
-
WSA-2026-28: [Xfer] Missing checks of the resume position received in DCC RESUME and DCC ACCEPT.
—
Fixed in version 4.10.3 ().
-
WSA-2026-27: [Relay] Denial of service with huge IRC messages received from a relay client.
—
Fixed in version 4.10.3 ().
-
WSA-2026-26: [IRC] Missing checks in SASL authentication with SCRAM mechanisms.
—
Fixed in version 4.10.3 ().
-
WSA-2026-25: [IRC] Evaluation of untrusted strings received from the IRC server or an IRC URL.
—
Fixed in version 4.10.2 ().
-
WSA-2026-24: [Relay] Missing size limit for HTTP headers received from a client.
—
Fixed in version 4.10.2 ().
-
WSA-2026-23: [Core] Heap buffer overflow in charset conversion.
—
Fixed in version 4.10.2 ().
-
WSA-2026-22: [Relay] Heap buffer overflow in path of hdata sent to clients with "weechat" protocol.
—
Fixed in version 4.10.2 ().
-
WSA-2026-21: [IRC] Heap buffer overflow in nick prefixes after a reconnection.
—
Fixed in version 4.10.2 ().
-
WSA-2026-20: [Relay] Missing size limit of data queued for sending to clients.
—
Fixed in version 4.10.1 ().
-
WSA-2026-19: [Relay] Missing rejection of invalid websocket frames.
—
Fixed in version 4.10.1 ().
-
WSA-2026-18: [Relay] Missing size limit for the unterminated Relay text message received from a client.
—
Fixed in version 4.10.1 ().
-
WSA-2026-17: [Xfer] Bypass of user authorization for start of DCC file transfer.
—
Fixed in version 4.10.1 ().
-
WSA-2026-16: [Xfer] Missing size limit for the unterminated Xfer chat message.
—
Fixed in version 4.10.1 ().
-
WSA-2026-15: [Xfer] Write of DCC file received outside of configured download path.
—
Fixed in version 4.10.1 ().
-
WSA-2026-14: [Relay] Use-after-free and double free when a remote relay sends an event with an array as body.
—
Fixed in version 4.9.5 ().
-
WSA-2026-13: [IRC] Use-after-free in the irc plugin when a batched message disconnects the server.
—
Fixed in version 4.9.5 ().
-
WSA-2026-12: [IRC] Stack buffer overflow when building a JOIN command with channel keys.
—
Fixed in version 4.9.5 ().
-
WSA-2026-11: [Logger] Write of logger file outside of configured path.
—
Fixed in version 4.9.4 ().
-
WSA-2026-10: [Relay] Authentication bypass in Relay plugin, protocols "api" and "weechat".
—
Fixed in version 4.9.4 ().
-
WSA-2026-9: [Relay] Memory leak in API relay, endpoint "handshake".
—
Fixed in version 4.9.3 ().
-
WSA-2026-8: [Relay] Buffer overflow in dump of Relay data.
—
Fixed in version 4.9.2 ().
-
WSA-2026-7: [Xfer] Buffer overflow when receiving a line in a Xfer chat (DCC chat) buffer.
—
Fixed in version 4.9.2 ().
-
WSA-2026-6: [Xfer] Write of DCC file received outside of configured download path.
—
Fixed in version 4.9.2 ().
-
WSA-2026-5: [IRC] Buffer overflow when receiving a DCC file.
—
Fixed in version 4.9.2 ().
-
WSA-2026-4: [Relay] Missing size limit for the received websocket frame, HTTP message and HTTP body.
—
Fixed in version 4.9.2 ().
-
WSA-2026-3: [IRC] Missing size limit for the unterminated IRC message or isupport value (message 005).
—
Fixed in version 4.9.2 ().
-
WSA-2026-2: [API, Relay] Non-constant time password/hash comparison.
—
Fixed in version 4.9.1 ().
-
WSA-2026-1: [Relay] Missing size limit for the decompressed websocket frame in relay plugin, protocol "api".
—
Fixed in version 4.9.1 ().
-
WSA-2025-8: [Relay] Crash on malformed HTTP message in relay plugin, protocol "api".
—
Fixed in version 4.7.1 ().
Affected by 31 vulnerabilities:
-
WSA-2026-32: [Relay] Denial of service with many passwords in command init received from a relay client.
—
Fixed in version 4.10.4 ().
-
WSA-2026-31: [Relay] Bypass of TOTP and denial of service with invalid TOTP received from a relay client.
—
Fixed in version 4.10.4 ().
-
WSA-2026-30: [Xfer] Incoming files and chats auto-accepted from a nick on the wrong server.
—
Fixed in version 4.10.3 ().
-
WSA-2026-29: [Relay] Missing check of the number of hash iterations received from a remote relay.
—
Fixed in version 4.10.3 ().
-
WSA-2026-28: [Xfer] Missing checks of the resume position received in DCC RESUME and DCC ACCEPT.
—
Fixed in version 4.10.3 ().
-
WSA-2026-27: [Relay] Denial of service with huge IRC messages received from a relay client.
—
Fixed in version 4.10.3 ().
-
WSA-2026-26: [IRC] Missing checks in SASL authentication with SCRAM mechanisms.
—
Fixed in version 4.10.3 ().
-
WSA-2026-25: [IRC] Evaluation of untrusted strings received from the IRC server or an IRC URL.
—
Fixed in version 4.10.2 ().
-
WSA-2026-24: [Relay] Missing size limit for HTTP headers received from a client.
—
Fixed in version 4.10.2 ().
-
WSA-2026-23: [Core] Heap buffer overflow in charset conversion.
—
Fixed in version 4.10.2 ().
-
WSA-2026-22: [Relay] Heap buffer overflow in path of hdata sent to clients with "weechat" protocol.
—
Fixed in version 4.10.2 ().
-
WSA-2026-21: [IRC] Heap buffer overflow in nick prefixes after a reconnection.
—
Fixed in version 4.10.2 ().
-
WSA-2026-20: [Relay] Missing size limit of data queued for sending to clients.
—
Fixed in version 4.10.1 ().
-
WSA-2026-19: [Relay] Missing rejection of invalid websocket frames.
—
Fixed in version 4.10.1 ().
-
WSA-2026-18: [Relay] Missing size limit for the unterminated Relay text message received from a client.
—
Fixed in version 4.10.1 ().
-
WSA-2026-17: [Xfer] Bypass of user authorization for start of DCC file transfer.
—
Fixed in version 4.10.1 ().
-
WSA-2026-16: [Xfer] Missing size limit for the unterminated Xfer chat message.
—
Fixed in version 4.10.1 ().
-
WSA-2026-15: [Xfer] Write of DCC file received outside of configured download path.
—
Fixed in version 4.10.1 ().
-
WSA-2026-14: [Relay] Use-after-free and double free when a remote relay sends an event with an array as body.
—
Fixed in version 4.9.5 ().
-
WSA-2026-13: [IRC] Use-after-free in the irc plugin when a batched message disconnects the server.
—
Fixed in version 4.9.5 ().
-
WSA-2026-12: [IRC] Stack buffer overflow when building a JOIN command with channel keys.
—
Fixed in version 4.9.5 ().
-
WSA-2026-11: [Logger] Write of logger file outside of configured path.
—
Fixed in version 4.9.4 ().
-
WSA-2026-10: [Relay] Authentication bypass in Relay plugin, protocols "api" and "weechat".
—
Fixed in version 4.9.4 ().
-
WSA-2026-8: [Relay] Buffer overflow in dump of Relay data.
—
Fixed in version 4.9.2 ().
-
WSA-2026-7: [Xfer] Buffer overflow when receiving a line in a Xfer chat (DCC chat) buffer.
—
Fixed in version 4.9.2 ().
-
WSA-2026-6: [Xfer] Write of DCC file received outside of configured download path.
—
Fixed in version 4.9.2 ().
-
WSA-2026-5: [IRC] Buffer overflow when receiving a DCC file.
—
Fixed in version 4.9.2 ().
-
WSA-2026-4: [Relay] Missing size limit for the received websocket frame, HTTP message and HTTP body.
—
Fixed in version 4.9.2 ().
-
WSA-2026-3: [IRC] Missing size limit for the unterminated IRC message or isupport value (message 005).
—
Fixed in version 4.9.2 ().
-
WSA-2026-2: [API, Relay] Non-constant time password/hash comparison.
—
Fixed in version 4.9.1 ().
-
WSA-2026-1: [Relay] Missing size limit for the decompressed websocket frame in relay plugin, protocol "api".
—
Fixed in version 4.9.1 ().
Affected by 38 vulnerabilities:
-
WSA-2026-32: [Relay] Denial of service with many passwords in command init received from a relay client.
—
Fixed in version 4.10.4 ().
-
WSA-2026-31: [Relay] Bypass of TOTP and denial of service with invalid TOTP received from a relay client.
—
Fixed in version 4.10.4 ().
-
WSA-2026-30: [Xfer] Incoming files and chats auto-accepted from a nick on the wrong server.
—
Fixed in version 4.10.3 ().
-
WSA-2026-29: [Relay] Missing check of the number of hash iterations received from a remote relay.
—
Fixed in version 4.10.3 ().
-
WSA-2026-28: [Xfer] Missing checks of the resume position received in DCC RESUME and DCC ACCEPT.
—
Fixed in version 4.10.3 ().
-
WSA-2026-27: [Relay] Denial of service with huge IRC messages received from a relay client.
—
Fixed in version 4.10.3 ().
-
WSA-2026-26: [IRC] Missing checks in SASL authentication with SCRAM mechanisms.
—
Fixed in version 4.10.3 ().
-
WSA-2026-25: [IRC] Evaluation of untrusted strings received from the IRC server or an IRC URL.
—
Fixed in version 4.10.2 ().
-
WSA-2026-24: [Relay] Missing size limit for HTTP headers received from a client.
—
Fixed in version 4.10.2 ().
-
WSA-2026-23: [Core] Heap buffer overflow in charset conversion.
—
Fixed in version 4.10.2 ().
-
WSA-2026-22: [Relay] Heap buffer overflow in path of hdata sent to clients with "weechat" protocol.
—
Fixed in version 4.10.2 ().
-
WSA-2026-21: [IRC] Heap buffer overflow in nick prefixes after a reconnection.
—
Fixed in version 4.10.2 ().
-
WSA-2026-20: [Relay] Missing size limit of data queued for sending to clients.
—
Fixed in version 4.10.1 ().
-
WSA-2026-19: [Relay] Missing rejection of invalid websocket frames.
—
Fixed in version 4.10.1 ().
-
WSA-2026-18: [Relay] Missing size limit for the unterminated Relay text message received from a client.
—
Fixed in version 4.10.1 ().
-
WSA-2026-17: [Xfer] Bypass of user authorization for start of DCC file transfer.
—
Fixed in version 4.10.1 ().
-
WSA-2026-16: [Xfer] Missing size limit for the unterminated Xfer chat message.
—
Fixed in version 4.10.1 ().
-
WSA-2026-15: [Xfer] Write of DCC file received outside of configured download path.
—
Fixed in version 4.10.1 ().
-
WSA-2026-14: [Relay] Use-after-free and double free when a remote relay sends an event with an array as body.
—
Fixed in version 4.9.5 ().
-
WSA-2026-13: [IRC] Use-after-free in the irc plugin when a batched message disconnects the server.
—
Fixed in version 4.9.5 ().
-
WSA-2026-12: [IRC] Stack buffer overflow when building a JOIN command with channel keys.
—
Fixed in version 4.9.5 ().
-
WSA-2026-11: [Logger] Write of logger file outside of configured path.
—
Fixed in version 4.9.4 ().
-
WSA-2026-10: [Relay] Authentication bypass in Relay plugin, protocols "api" and "weechat".
—
Fixed in version 4.9.4 ().
-
WSA-2026-8: [Relay] Buffer overflow in dump of Relay data.
—
Fixed in version 4.9.2 ().
-
WSA-2026-7: [Xfer] Buffer overflow when receiving a line in a Xfer chat (DCC chat) buffer.
—
Fixed in version 4.9.2 ().
-
WSA-2026-6: [Xfer] Write of DCC file received outside of configured download path.
—
Fixed in version 4.9.2 ().
-
WSA-2026-5: [IRC] Buffer overflow when receiving a DCC file.
—
Fixed in version 4.9.2 ().
-
WSA-2026-4: [Relay] Missing size limit for the received websocket frame, HTTP message and HTTP body.
—
Fixed in version 4.9.2 ().
-
WSA-2026-3: [IRC] Missing size limit for the unterminated IRC message or isupport value (message 005).
—
Fixed in version 4.9.2 ().
-
WSA-2026-2: [API, Relay] Non-constant time password/hash comparison.
—
Fixed in version 4.9.1 ().
-
WSA-2026-1: [Relay] Missing size limit for the decompressed websocket frame in relay plugin, protocol "api".
—
Fixed in version 4.9.1 ().
-
WSA-2025-7: [Core] Buffer overflow in range of chars in evaluated expressions.
—
Fixed in version 4.6.3 ().
-
WSA-2025-6: [Core] Buffer overflow in base 32 encoding in evaluated expressions.
—
Fixed in version 4.6.3 ().
-
WSA-2025-5: [Core] Buffer overflow in syntax highlighting of evaluated expressions.
—
Fixed in version 4.6.3 ().
-
WSA-2025-4: [Core] Buffer overflow in parsing of date/time.
—
Fixed in version 4.6.3 ().
-
WSA-2025-3: [Core] Integer overflow in conversion of version to an integer number.
—
Fixed in version 4.6.3 ().
-
WSA-2025-2: [Core] Integer overflow in base32 decode/encode functions.
—
Fixed in version 4.6.3 ().
-
WSA-2025-1: [Core] Integer overflow with decimal numbers in calculation of expression.
—
Fixed in version 4.6.3 ().
Affected by 38 vulnerabilities:
-
WSA-2026-32: [Relay] Denial of service with many passwords in command init received from a relay client.
—
Fixed in version 4.10.4 ().
-
WSA-2026-31: [Relay] Bypass of TOTP and denial of service with invalid TOTP received from a relay client.
—
Fixed in version 4.10.4 ().
-
WSA-2026-30: [Xfer] Incoming files and chats auto-accepted from a nick on the wrong server.
—
Fixed in version 4.10.3 ().
-
WSA-2026-29: [Relay] Missing check of the number of hash iterations received from a remote relay.
—
Fixed in version 4.10.3 ().
-
WSA-2026-28: [Xfer] Missing checks of the resume position received in DCC RESUME and DCC ACCEPT.
—
Fixed in version 4.10.3 ().
-
WSA-2026-27: [Relay] Denial of service with huge IRC messages received from a relay client.
—
Fixed in version 4.10.3 ().
-
WSA-2026-26: [IRC] Missing checks in SASL authentication with SCRAM mechanisms.
—
Fixed in version 4.10.3 ().
-
WSA-2026-25: [IRC] Evaluation of untrusted strings received from the IRC server or an IRC URL.
—
Fixed in version 4.10.2 ().
-
WSA-2026-24: [Relay] Missing size limit for HTTP headers received from a client.
—
Fixed in version 4.10.2 ().
-
WSA-2026-23: [Core] Heap buffer overflow in charset conversion.
—
Fixed in version 4.10.2 ().
-
WSA-2026-22: [Relay] Heap buffer overflow in path of hdata sent to clients with "weechat" protocol.
—
Fixed in version 4.10.2 ().
-
WSA-2026-21: [IRC] Heap buffer overflow in nick prefixes after a reconnection.
—
Fixed in version 4.10.2 ().
-
WSA-2026-20: [Relay] Missing size limit of data queued for sending to clients.
—
Fixed in version 4.10.1 ().
-
WSA-2026-19: [Relay] Missing rejection of invalid websocket frames.
—
Fixed in version 4.10.1 ().
-
WSA-2026-18: [Relay] Missing size limit for the unterminated Relay text message received from a client.
—
Fixed in version 4.10.1 ().
-
WSA-2026-17: [Xfer] Bypass of user authorization for start of DCC file transfer.
—
Fixed in version 4.10.1 ().
-
WSA-2026-16: [Xfer] Missing size limit for the unterminated Xfer chat message.
—
Fixed in version 4.10.1 ().
-
WSA-2026-15: [Xfer] Write of DCC file received outside of configured download path.
—
Fixed in version 4.10.1 ().
-
WSA-2026-14: [Relay] Use-after-free and double free when a remote relay sends an event with an array as body.
—
Fixed in version 4.9.5 ().
-
WSA-2026-13: [IRC] Use-after-free in the irc plugin when a batched message disconnects the server.
—
Fixed in version 4.9.5 ().
-
WSA-2026-12: [IRC] Stack buffer overflow when building a JOIN command with channel keys.
—
Fixed in version 4.9.5 ().
-
WSA-2026-11: [Logger] Write of logger file outside of configured path.
—
Fixed in version 4.9.4 ().
-
WSA-2026-10: [Relay] Authentication bypass in Relay plugin, protocols "api" and "weechat".
—
Fixed in version 4.9.4 ().
-
WSA-2026-8: [Relay] Buffer overflow in dump of Relay data.
—
Fixed in version 4.9.2 ().
-
WSA-2026-7: [Xfer] Buffer overflow when receiving a line in a Xfer chat (DCC chat) buffer.
—
Fixed in version 4.9.2 ().
-
WSA-2026-6: [Xfer] Write of DCC file received outside of configured download path.
—
Fixed in version 4.9.2 ().
-
WSA-2026-5: [IRC] Buffer overflow when receiving a DCC file.
—
Fixed in version 4.9.2 ().
-
WSA-2026-4: [Relay] Missing size limit for the received websocket frame, HTTP message and HTTP body.
—
Fixed in version 4.9.2 ().
-
WSA-2026-3: [IRC] Missing size limit for the unterminated IRC message or isupport value (message 005).
—
Fixed in version 4.9.2 ().
-
WSA-2026-2: [API, Relay] Non-constant time password/hash comparison.
—
Fixed in version 4.9.1 ().
-
WSA-2026-1: [Relay] Missing size limit for the decompressed websocket frame in relay plugin, protocol "api".
—
Fixed in version 4.9.1 ().
-
WSA-2025-7: [Core] Buffer overflow in range of chars in evaluated expressions.
—
Fixed in version 4.6.3 ().
-
WSA-2025-6: [Core] Buffer overflow in base 32 encoding in evaluated expressions.
—
Fixed in version 4.6.3 ().
-
WSA-2025-5: [Core] Buffer overflow in syntax highlighting of evaluated expressions.
—
Fixed in version 4.6.3 ().
-
WSA-2025-4: [Core] Buffer overflow in parsing of date/time.
—
Fixed in version 4.6.3 ().
-
WSA-2025-3: [Core] Integer overflow in conversion of version to an integer number.
—
Fixed in version 4.6.3 ().
-
WSA-2025-2: [Core] Integer overflow in base32 decode/encode functions.
—
Fixed in version 4.6.3 ().
-
WSA-2025-1: [Core] Integer overflow with decimal numbers in calculation of expression.
—
Fixed in version 4.6.3 ().
Affected by 38 vulnerabilities:
-
WSA-2026-32: [Relay] Denial of service with many passwords in command init received from a relay client.
—
Fixed in version 4.10.4 ().
-
WSA-2026-31: [Relay] Bypass of TOTP and denial of service with invalid TOTP received from a relay client.
—
Fixed in version 4.10.4 ().
-
WSA-2026-30: [Xfer] Incoming files and chats auto-accepted from a nick on the wrong server.
—
Fixed in version 4.10.3 ().
-
WSA-2026-29: [Relay] Missing check of the number of hash iterations received from a remote relay.
—
Fixed in version 4.10.3 ().
-
WSA-2026-28: [Xfer] Missing checks of the resume position received in DCC RESUME and DCC ACCEPT.
—
Fixed in version 4.10.3 ().
-
WSA-2026-27: [Relay] Denial of service with huge IRC messages received from a relay client.
—
Fixed in version 4.10.3 ().
-
WSA-2026-26: [IRC] Missing checks in SASL authentication with SCRAM mechanisms.
—
Fixed in version 4.10.3 ().
-
WSA-2026-25: [IRC] Evaluation of untrusted strings received from the IRC server or an IRC URL.
—
Fixed in version 4.10.2 ().
-
WSA-2026-24: [Relay] Missing size limit for HTTP headers received from a client.
—
Fixed in version 4.10.2 ().
-
WSA-2026-23: [Core] Heap buffer overflow in charset conversion.
—
Fixed in version 4.10.2 ().
-
WSA-2026-22: [Relay] Heap buffer overflow in path of hdata sent to clients with "weechat" protocol.
—
Fixed in version 4.10.2 ().
-
WSA-2026-21: [IRC] Heap buffer overflow in nick prefixes after a reconnection.
—
Fixed in version 4.10.2 ().
-
WSA-2026-20: [Relay] Missing size limit of data queued for sending to clients.
—
Fixed in version 4.10.1 ().
-
WSA-2026-19: [Relay] Missing rejection of invalid websocket frames.
—
Fixed in version 4.10.1 ().
-
WSA-2026-18: [Relay] Missing size limit for the unterminated Relay text message received from a client.
—
Fixed in version 4.10.1 ().
-
WSA-2026-17: [Xfer] Bypass of user authorization for start of DCC file transfer.
—
Fixed in version 4.10.1 ().
-
WSA-2026-16: [Xfer] Missing size limit for the unterminated Xfer chat message.
—
Fixed in version 4.10.1 ().
-
WSA-2026-15: [Xfer] Write of DCC file received outside of configured download path.
—
Fixed in version 4.10.1 ().
-
WSA-2026-14: [Relay] Use-after-free and double free when a remote relay sends an event with an array as body.
—
Fixed in version 4.9.5 ().
-
WSA-2026-13: [IRC] Use-after-free in the irc plugin when a batched message disconnects the server.
—
Fixed in version 4.9.5 ().
-
WSA-2026-12: [IRC] Stack buffer overflow when building a JOIN command with channel keys.
—
Fixed in version 4.9.5 ().
-
WSA-2026-11: [Logger] Write of logger file outside of configured path.
—
Fixed in version 4.9.4 ().
-
WSA-2026-10: [Relay] Authentication bypass in Relay plugin, protocols "api" and "weechat".
—
Fixed in version 4.9.4 ().
-
WSA-2026-8: [Relay] Buffer overflow in dump of Relay data.
—
Fixed in version 4.9.2 ().
-
WSA-2026-7: [Xfer] Buffer overflow when receiving a line in a Xfer chat (DCC chat) buffer.
—
Fixed in version 4.9.2 ().
-
WSA-2026-6: [Xfer] Write of DCC file received outside of configured download path.
—
Fixed in version 4.9.2 ().
-
WSA-2026-5: [IRC] Buffer overflow when receiving a DCC file.
—
Fixed in version 4.9.2 ().
-
WSA-2026-4: [Relay] Missing size limit for the received websocket frame, HTTP message and HTTP body.
—
Fixed in version 4.9.2 ().
-
WSA-2026-3: [IRC] Missing size limit for the unterminated IRC message or isupport value (message 005).
—
Fixed in version 4.9.2 ().
-
WSA-2026-2: [API, Relay] Non-constant time password/hash comparison.
—
Fixed in version 4.9.1 ().
-
WSA-2026-1: [Relay] Missing size limit for the decompressed websocket frame in relay plugin, protocol "api".
—
Fixed in version 4.9.1 ().
-
WSA-2025-7: [Core] Buffer overflow in range of chars in evaluated expressions.
—
Fixed in version 4.6.3 ().
-
WSA-2025-6: [Core] Buffer overflow in base 32 encoding in evaluated expressions.
—
Fixed in version 4.6.3 ().
-
WSA-2025-5: [Core] Buffer overflow in syntax highlighting of evaluated expressions.
—
Fixed in version 4.6.3 ().
-
WSA-2025-4: [Core] Buffer overflow in parsing of date/time.
—
Fixed in version 4.6.3 ().
-
WSA-2025-3: [Core] Integer overflow in conversion of version to an integer number.
—
Fixed in version 4.6.3 ().
-
WSA-2025-2: [Core] Integer overflow in base32 decode/encode functions.
—
Fixed in version 4.6.3 ().
-
WSA-2025-1: [Core] Integer overflow with decimal numbers in calculation of expression.
—
Fixed in version 4.6.3 ().
Affected by 38 vulnerabilities:
-
WSA-2026-32: [Relay] Denial of service with many passwords in command init received from a relay client.
—
Fixed in version 4.10.4 ().
-
WSA-2026-31: [Relay] Bypass of TOTP and denial of service with invalid TOTP received from a relay client.
—
Fixed in version 4.10.4 ().
-
WSA-2026-30: [Xfer] Incoming files and chats auto-accepted from a nick on the wrong server.
—
Fixed in version 4.10.3 ().
-
WSA-2026-29: [Relay] Missing check of the number of hash iterations received from a remote relay.
—
Fixed in version 4.10.3 ().
-
WSA-2026-28: [Xfer] Missing checks of the resume position received in DCC RESUME and DCC ACCEPT.
—
Fixed in version 4.10.3 ().
-
WSA-2026-27: [Relay] Denial of service with huge IRC messages received from a relay client.
—
Fixed in version 4.10.3 ().
-
WSA-2026-26: [IRC] Missing checks in SASL authentication with SCRAM mechanisms.
—
Fixed in version 4.10.3 ().
-
WSA-2026-25: [IRC] Evaluation of untrusted strings received from the IRC server or an IRC URL.
—
Fixed in version 4.10.2 ().
-
WSA-2026-24: [Relay] Missing size limit for HTTP headers received from a client.
—
Fixed in version 4.10.2 ().
-
WSA-2026-23: [Core] Heap buffer overflow in charset conversion.
—
Fixed in version 4.10.2 ().
-
WSA-2026-22: [Relay] Heap buffer overflow in path of hdata sent to clients with "weechat" protocol.
—
Fixed in version 4.10.2 ().
-
WSA-2026-21: [IRC] Heap buffer overflow in nick prefixes after a reconnection.
—
Fixed in version 4.10.2 ().
-
WSA-2026-20: [Relay] Missing size limit of data queued for sending to clients.
—
Fixed in version 4.10.1 ().
-
WSA-2026-19: [Relay] Missing rejection of invalid websocket frames.
—
Fixed in version 4.10.1 ().
-
WSA-2026-18: [Relay] Missing size limit for the unterminated Relay text message received from a client.
—
Fixed in version 4.10.1 ().
-
WSA-2026-17: [Xfer] Bypass of user authorization for start of DCC file transfer.
—
Fixed in version 4.10.1 ().
-
WSA-2026-16: [Xfer] Missing size limit for the unterminated Xfer chat message.
—
Fixed in version 4.10.1 ().
-
WSA-2026-15: [Xfer] Write of DCC file received outside of configured download path.
—
Fixed in version 4.10.1 ().
-
WSA-2026-14: [Relay] Use-after-free and double free when a remote relay sends an event with an array as body.
—
Fixed in version 4.9.5 ().
-
WSA-2026-13: [IRC] Use-after-free in the irc plugin when a batched message disconnects the server.
—
Fixed in version 4.9.5 ().
-
WSA-2026-12: [IRC] Stack buffer overflow when building a JOIN command with channel keys.
—
Fixed in version 4.9.5 ().
-
WSA-2026-11: [Logger] Write of logger file outside of configured path.
—
Fixed in version 4.9.4 ().
-
WSA-2026-10: [Relay] Authentication bypass in Relay plugin, protocols "api" and "weechat".
—
Fixed in version 4.9.4 ().
-
WSA-2026-8: [Relay] Buffer overflow in dump of Relay data.
—
Fixed in version 4.9.2 ().
-
WSA-2026-7: [Xfer] Buffer overflow when receiving a line in a Xfer chat (DCC chat) buffer.
—
Fixed in version 4.9.2 ().
-
WSA-2026-6: [Xfer] Write of DCC file received outside of configured download path.
—
Fixed in version 4.9.2 ().
-
WSA-2026-5: [IRC] Buffer overflow when receiving a DCC file.
—
Fixed in version 4.9.2 ().
-
WSA-2026-4: [Relay] Missing size limit for the received websocket frame, HTTP message and HTTP body.
—
Fixed in version 4.9.2 ().
-
WSA-2026-3: [IRC] Missing size limit for the unterminated IRC message or isupport value (message 005).
—
Fixed in version 4.9.2 ().
-
WSA-2026-2: [API, Relay] Non-constant time password/hash comparison.
—
Fixed in version 4.9.1 ().
-
WSA-2026-1: [Relay] Missing size limit for the decompressed websocket frame in relay plugin, protocol "api".
—
Fixed in version 4.9.1 ().
-
WSA-2025-7: [Core] Buffer overflow in range of chars in evaluated expressions.
—
Fixed in version 4.6.3 ().
-
WSA-2025-6: [Core] Buffer overflow in base 32 encoding in evaluated expressions.
—
Fixed in version 4.6.3 ().
-
WSA-2025-5: [Core] Buffer overflow in syntax highlighting of evaluated expressions.
—
Fixed in version 4.6.3 ().
-
WSA-2025-4: [Core] Buffer overflow in parsing of date/time.
—
Fixed in version 4.6.3 ().
-
WSA-2025-3: [Core] Integer overflow in conversion of version to an integer number.
—
Fixed in version 4.6.3 ().
-
WSA-2025-2: [Core] Integer overflow in base32 decode/encode functions.
—
Fixed in version 4.6.3 ().
-
WSA-2025-1: [Core] Integer overflow with decimal numbers in calculation of expression.
—
Fixed in version 4.6.3 ().
Affected by 38 vulnerabilities:
-
WSA-2026-32: [Relay] Denial of service with many passwords in command init received from a relay client.
—
Fixed in version 4.10.4 ().
-
WSA-2026-31: [Relay] Bypass of TOTP and denial of service with invalid TOTP received from a relay client.
—
Fixed in version 4.10.4 ().
-
WSA-2026-30: [Xfer] Incoming files and chats auto-accepted from a nick on the wrong server.
—
Fixed in version 4.10.3 ().
-
WSA-2026-29: [Relay] Missing check of the number of hash iterations received from a remote relay.
—
Fixed in version 4.10.3 ().
-
WSA-2026-28: [Xfer] Missing checks of the resume position received in DCC RESUME and DCC ACCEPT.
—
Fixed in version 4.10.3 ().
-
WSA-2026-27: [Relay] Denial of service with huge IRC messages received from a relay client.
—
Fixed in version 4.10.3 ().
-
WSA-2026-26: [IRC] Missing checks in SASL authentication with SCRAM mechanisms.
—
Fixed in version 4.10.3 ().
-
WSA-2026-25: [IRC] Evaluation of untrusted strings received from the IRC server or an IRC URL.
—
Fixed in version 4.10.2 ().
-
WSA-2026-24: [Relay] Missing size limit for HTTP headers received from a client.
—
Fixed in version 4.10.2 ().
-
WSA-2026-23: [Core] Heap buffer overflow in charset conversion.
—
Fixed in version 4.10.2 ().
-
WSA-2026-22: [Relay] Heap buffer overflow in path of hdata sent to clients with "weechat" protocol.
—
Fixed in version 4.10.2 ().
-
WSA-2026-21: [IRC] Heap buffer overflow in nick prefixes after a reconnection.
—
Fixed in version 4.10.2 ().
-
WSA-2026-20: [Relay] Missing size limit of data queued for sending to clients.
—
Fixed in version 4.10.1 ().
-
WSA-2026-19: [Relay] Missing rejection of invalid websocket frames.
—
Fixed in version 4.10.1 ().
-
WSA-2026-18: [Relay] Missing size limit for the unterminated Relay text message received from a client.
—
Fixed in version 4.10.1 ().
-
WSA-2026-17: [Xfer] Bypass of user authorization for start of DCC file transfer.
—
Fixed in version 4.10.1 ().
-
WSA-2026-16: [Xfer] Missing size limit for the unterminated Xfer chat message.
—
Fixed in version 4.10.1 ().
-
WSA-2026-15: [Xfer] Write of DCC file received outside of configured download path.
—
Fixed in version 4.10.1 ().
-
WSA-2026-14: [Relay] Use-after-free and double free when a remote relay sends an event with an array as body.
—
Fixed in version 4.9.5 ().
-
WSA-2026-13: [IRC] Use-after-free in the irc plugin when a batched message disconnects the server.
—
Fixed in version 4.9.5 ().
-
WSA-2026-12: [IRC] Stack buffer overflow when building a JOIN command with channel keys.
—
Fixed in version 4.9.5 ().
-
WSA-2026-11: [Logger] Write of logger file outside of configured path.
—
Fixed in version 4.9.4 ().
-
WSA-2026-10: [Relay] Authentication bypass in Relay plugin, protocols "api" and "weechat".
—
Fixed in version 4.9.4 ().
-
WSA-2026-8: [Relay] Buffer overflow in dump of Relay data.
—
Fixed in version 4.9.2 ().
-
WSA-2026-7: [Xfer] Buffer overflow when receiving a line in a Xfer chat (DCC chat) buffer.
—
Fixed in version 4.9.2 ().
-
WSA-2026-6: [Xfer] Write of DCC file received outside of configured download path.
—
Fixed in version 4.9.2 ().
-
WSA-2026-5: [IRC] Buffer overflow when receiving a DCC file.
—
Fixed in version 4.9.2 ().
-
WSA-2026-4: [Relay] Missing size limit for the received websocket frame, HTTP message and HTTP body.
—
Fixed in version 4.9.2 ().
-
WSA-2026-3: [IRC] Missing size limit for the unterminated IRC message or isupport value (message 005).
—
Fixed in version 4.9.2 ().
-
WSA-2026-2: [API, Relay] Non-constant time password/hash comparison.
—
Fixed in version 4.9.1 ().
-
WSA-2026-1: [Relay] Missing size limit for the decompressed websocket frame in relay plugin, protocol "api".
—
Fixed in version 4.9.1 ().
-
WSA-2025-7: [Core] Buffer overflow in range of chars in evaluated expressions.
—
Fixed in version 4.6.3 ().
-
WSA-2025-6: [Core] Buffer overflow in base 32 encoding in evaluated expressions.
—
Fixed in version 4.6.3 ().
-
WSA-2025-5: [Core] Buffer overflow in syntax highlighting of evaluated expressions.
—
Fixed in version 4.6.3 ().
-
WSA-2025-4: [Core] Buffer overflow in parsing of date/time.
—
Fixed in version 4.6.3 ().
-
WSA-2025-3: [Core] Integer overflow in conversion of version to an integer number.
—
Fixed in version 4.6.3 ().
-
WSA-2025-2: [Core] Integer overflow in base32 decode/encode functions.
—
Fixed in version 4.6.3 ().
-
WSA-2025-1: [Core] Integer overflow with decimal numbers in calculation of expression.
—
Fixed in version 4.6.3 ().
Affected by 38 vulnerabilities:
-
WSA-2026-32: [Relay] Denial of service with many passwords in command init received from a relay client.
—
Fixed in version 4.10.4 ().
-
WSA-2026-31: [Relay] Bypass of TOTP and denial of service with invalid TOTP received from a relay client.
—
Fixed in version 4.10.4 ().
-
WSA-2026-30: [Xfer] Incoming files and chats auto-accepted from a nick on the wrong server.
—
Fixed in version 4.10.3 ().
-
WSA-2026-29: [Relay] Missing check of the number of hash iterations received from a remote relay.
—
Fixed in version 4.10.3 ().
-
WSA-2026-28: [Xfer] Missing checks of the resume position received in DCC RESUME and DCC ACCEPT.
—
Fixed in version 4.10.3 ().
-
WSA-2026-27: [Relay] Denial of service with huge IRC messages received from a relay client.
—
Fixed in version 4.10.3 ().
-
WSA-2026-26: [IRC] Missing checks in SASL authentication with SCRAM mechanisms.
—
Fixed in version 4.10.3 ().
-
WSA-2026-25: [IRC] Evaluation of untrusted strings received from the IRC server or an IRC URL.
—
Fixed in version 4.10.2 ().
-
WSA-2026-24: [Relay] Missing size limit for HTTP headers received from a client.
—
Fixed in version 4.10.2 ().
-
WSA-2026-23: [Core] Heap buffer overflow in charset conversion.
—
Fixed in version 4.10.2 ().
-
WSA-2026-22: [Relay] Heap buffer overflow in path of hdata sent to clients with "weechat" protocol.
—
Fixed in version 4.10.2 ().
-
WSA-2026-21: [IRC] Heap buffer overflow in nick prefixes after a reconnection.
—
Fixed in version 4.10.2 ().
-
WSA-2026-20: [Relay] Missing size limit of data queued for sending to clients.
—
Fixed in version 4.10.1 ().
-
WSA-2026-19: [Relay] Missing rejection of invalid websocket frames.
—
Fixed in version 4.10.1 ().
-
WSA-2026-18: [Relay] Missing size limit for the unterminated Relay text message received from a client.
—
Fixed in version 4.10.1 ().
-
WSA-2026-17: [Xfer] Bypass of user authorization for start of DCC file transfer.
—
Fixed in version 4.10.1 ().
-
WSA-2026-16: [Xfer] Missing size limit for the unterminated Xfer chat message.
—
Fixed in version 4.10.1 ().
-
WSA-2026-15: [Xfer] Write of DCC file received outside of configured download path.
—
Fixed in version 4.10.1 ().
-
WSA-2026-14: [Relay] Use-after-free and double free when a remote relay sends an event with an array as body.
—
Fixed in version 4.9.5 ().
-
WSA-2026-13: [IRC] Use-after-free in the irc plugin when a batched message disconnects the server.
—
Fixed in version 4.9.5 ().
-
WSA-2026-12: [IRC] Stack buffer overflow when building a JOIN command with channel keys.
—
Fixed in version 4.9.5 ().
-
WSA-2026-11: [Logger] Write of logger file outside of configured path.
—
Fixed in version 4.9.4 ().
-
WSA-2026-10: [Relay] Authentication bypass in Relay plugin, protocols "api" and "weechat".
—
Fixed in version 4.9.4 ().
-
WSA-2026-8: [Relay] Buffer overflow in dump of Relay data.
—
Fixed in version 4.9.2 ().
-
WSA-2026-7: [Xfer] Buffer overflow when receiving a line in a Xfer chat (DCC chat) buffer.
—
Fixed in version 4.9.2 ().
-
WSA-2026-6: [Xfer] Write of DCC file received outside of configured download path.
—
Fixed in version 4.9.2 ().
-
WSA-2026-5: [IRC] Buffer overflow when receiving a DCC file.
—
Fixed in version 4.9.2 ().
-
WSA-2026-4: [Relay] Missing size limit for the received websocket frame, HTTP message and HTTP body.
—
Fixed in version 4.9.2 ().
-
WSA-2026-3: [IRC] Missing size limit for the unterminated IRC message or isupport value (message 005).
—
Fixed in version 4.9.2 ().
-
WSA-2026-2: [API, Relay] Non-constant time password/hash comparison.
—
Fixed in version 4.9.1 ().
-
WSA-2026-1: [Relay] Missing size limit for the decompressed websocket frame in relay plugin, protocol "api".
—
Fixed in version 4.9.1 ().
-
WSA-2025-7: [Core] Buffer overflow in range of chars in evaluated expressions.
—
Fixed in version 4.6.3 ().
-
WSA-2025-6: [Core] Buffer overflow in base 32 encoding in evaluated expressions.
—
Fixed in version 4.6.3 ().
-
WSA-2025-5: [Core] Buffer overflow in syntax highlighting of evaluated expressions.
—
Fixed in version 4.6.3 ().
-
WSA-2025-4: [Core] Buffer overflow in parsing of date/time.
—
Fixed in version 4.6.3 ().
-
WSA-2025-3: [Core] Integer overflow in conversion of version to an integer number.
—
Fixed in version 4.6.3 ().
-
WSA-2025-2: [Core] Integer overflow in base32 decode/encode functions.
—
Fixed in version 4.6.3 ().
-
WSA-2025-1: [Core] Integer overflow with decimal numbers in calculation of expression.
—
Fixed in version 4.6.3 ().
Affected by 38 vulnerabilities:
-
WSA-2026-32: [Relay] Denial of service with many passwords in command init received from a relay client.
—
Fixed in version 4.10.4 ().
-
WSA-2026-31: [Relay] Bypass of TOTP and denial of service with invalid TOTP received from a relay client.
—
Fixed in version 4.10.4 ().
-
WSA-2026-30: [Xfer] Incoming files and chats auto-accepted from a nick on the wrong server.
—
Fixed in version 4.10.3 ().
-
WSA-2026-29: [Relay] Missing check of the number of hash iterations received from a remote relay.
—
Fixed in version 4.10.3 ().
-
WSA-2026-28: [Xfer] Missing checks of the resume position received in DCC RESUME and DCC ACCEPT.
—
Fixed in version 4.10.3 ().
-
WSA-2026-27: [Relay] Denial of service with huge IRC messages received from a relay client.
—
Fixed in version 4.10.3 ().
-
WSA-2026-26: [IRC] Missing checks in SASL authentication with SCRAM mechanisms.
—
Fixed in version 4.10.3 ().
-
WSA-2026-25: [IRC] Evaluation of untrusted strings received from the IRC server or an IRC URL.
—
Fixed in version 4.10.2 ().
-
WSA-2026-24: [Relay] Missing size limit for HTTP headers received from a client.
—
Fixed in version 4.10.2 ().
-
WSA-2026-23: [Core] Heap buffer overflow in charset conversion.
—
Fixed in version 4.10.2 ().
-
WSA-2026-22: [Relay] Heap buffer overflow in path of hdata sent to clients with "weechat" protocol.
—
Fixed in version 4.10.2 ().
-
WSA-2026-21: [IRC] Heap buffer overflow in nick prefixes after a reconnection.
—
Fixed in version 4.10.2 ().
-
WSA-2026-20: [Relay] Missing size limit of data queued for sending to clients.
—
Fixed in version 4.10.1 ().
-
WSA-2026-19: [Relay] Missing rejection of invalid websocket frames.
—
Fixed in version 4.10.1 ().
-
WSA-2026-18: [Relay] Missing size limit for the unterminated Relay text message received from a client.
—
Fixed in version 4.10.1 ().
-
WSA-2026-17: [Xfer] Bypass of user authorization for start of DCC file transfer.
—
Fixed in version 4.10.1 ().
-
WSA-2026-16: [Xfer] Missing size limit for the unterminated Xfer chat message.
—
Fixed in version 4.10.1 ().
-
WSA-2026-15: [Xfer] Write of DCC file received outside of configured download path.
—
Fixed in version 4.10.1 ().
-
WSA-2026-14: [Relay] Use-after-free and double free when a remote relay sends an event with an array as body.
—
Fixed in version 4.9.5 ().
-
WSA-2026-13: [IRC] Use-after-free in the irc plugin when a batched message disconnects the server.
—
Fixed in version 4.9.5 ().
-
WSA-2026-12: [IRC] Stack buffer overflow when building a JOIN command with channel keys.
—
Fixed in version 4.9.5 ().
-
WSA-2026-11: [Logger] Write of logger file outside of configured path.
—
Fixed in version 4.9.4 ().
-
WSA-2026-10: [Relay] Authentication bypass in Relay plugin, protocols "api" and "weechat".
—
Fixed in version 4.9.4 ().
-
WSA-2026-8: [Relay] Buffer overflow in dump of Relay data.
—
Fixed in version 4.9.2 ().
-
WSA-2026-7: [Xfer] Buffer overflow when receiving a line in a Xfer chat (DCC chat) buffer.
—
Fixed in version 4.9.2 ().
-
WSA-2026-6: [Xfer] Write of DCC file received outside of configured download path.
—
Fixed in version 4.9.2 ().
-
WSA-2026-5: [IRC] Buffer overflow when receiving a DCC file.
—
Fixed in version 4.9.2 ().
-
WSA-2026-4: [Relay] Missing size limit for the received websocket frame, HTTP message and HTTP body.
—
Fixed in version 4.9.2 ().
-
WSA-2026-3: [IRC] Missing size limit for the unterminated IRC message or isupport value (message 005).
—
Fixed in version 4.9.2 ().
-
WSA-2026-2: [API, Relay] Non-constant time password/hash comparison.
—
Fixed in version 4.9.1 ().
-
WSA-2026-1: [Relay] Missing size limit for the decompressed websocket frame in relay plugin, protocol "api".
—
Fixed in version 4.9.1 ().
-
WSA-2025-7: [Core] Buffer overflow in range of chars in evaluated expressions.
—
Fixed in version 4.6.3 ().
-
WSA-2025-6: [Core] Buffer overflow in base 32 encoding in evaluated expressions.
—
Fixed in version 4.6.3 ().
-
WSA-2025-5: [Core] Buffer overflow in syntax highlighting of evaluated expressions.
—
Fixed in version 4.6.3 ().
-
WSA-2025-4: [Core] Buffer overflow in parsing of date/time.
—
Fixed in version 4.6.3 ().
-
WSA-2025-3: [Core] Integer overflow in conversion of version to an integer number.
—
Fixed in version 4.6.3 ().
-
WSA-2025-2: [Core] Integer overflow in base32 decode/encode functions.
—
Fixed in version 4.6.3 ().
-
WSA-2025-1: [Core] Integer overflow with decimal numbers in calculation of expression.
—
Fixed in version 4.6.3 ().
Affected by 38 vulnerabilities:
-
WSA-2026-32: [Relay] Denial of service with many passwords in command init received from a relay client.
—
Fixed in version 4.10.4 ().
-
WSA-2026-31: [Relay] Bypass of TOTP and denial of service with invalid TOTP received from a relay client.
—
Fixed in version 4.10.4 ().
-
WSA-2026-30: [Xfer] Incoming files and chats auto-accepted from a nick on the wrong server.
—
Fixed in version 4.10.3 ().
-
WSA-2026-29: [Relay] Missing check of the number of hash iterations received from a remote relay.
—
Fixed in version 4.10.3 ().
-
WSA-2026-28: [Xfer] Missing checks of the resume position received in DCC RESUME and DCC ACCEPT.
—
Fixed in version 4.10.3 ().
-
WSA-2026-27: [Relay] Denial of service with huge IRC messages received from a relay client.
—
Fixed in version 4.10.3 ().
-
WSA-2026-26: [IRC] Missing checks in SASL authentication with SCRAM mechanisms.
—
Fixed in version 4.10.3 ().
-
WSA-2026-25: [IRC] Evaluation of untrusted strings received from the IRC server or an IRC URL.
—
Fixed in version 4.10.2 ().
-
WSA-2026-24: [Relay] Missing size limit for HTTP headers received from a client.
—
Fixed in version 4.10.2 ().
-
WSA-2026-23: [Core] Heap buffer overflow in charset conversion.
—
Fixed in version 4.10.2 ().
-
WSA-2026-22: [Relay] Heap buffer overflow in path of hdata sent to clients with "weechat" protocol.
—
Fixed in version 4.10.2 ().
-
WSA-2026-21: [IRC] Heap buffer overflow in nick prefixes after a reconnection.
—
Fixed in version 4.10.2 ().
-
WSA-2026-20: [Relay] Missing size limit of data queued for sending to clients.
—
Fixed in version 4.10.1 ().
-
WSA-2026-19: [Relay] Missing rejection of invalid websocket frames.
—
Fixed in version 4.10.1 ().
-
WSA-2026-18: [Relay] Missing size limit for the unterminated Relay text message received from a client.
—
Fixed in version 4.10.1 ().
-
WSA-2026-17: [Xfer] Bypass of user authorization for start of DCC file transfer.
—
Fixed in version 4.10.1 ().
-
WSA-2026-16: [Xfer] Missing size limit for the unterminated Xfer chat message.
—
Fixed in version 4.10.1 ().
-
WSA-2026-15: [Xfer] Write of DCC file received outside of configured download path.
—
Fixed in version 4.10.1 ().
-
WSA-2026-14: [Relay] Use-after-free and double free when a remote relay sends an event with an array as body.
—
Fixed in version 4.9.5 ().
-
WSA-2026-13: [IRC] Use-after-free in the irc plugin when a batched message disconnects the server.
—
Fixed in version 4.9.5 ().
-
WSA-2026-12: [IRC] Stack buffer overflow when building a JOIN command with channel keys.
—
Fixed in version 4.9.5 ().
-
WSA-2026-11: [Logger] Write of logger file outside of configured path.
—
Fixed in version 4.9.4 ().
-
WSA-2026-10: [Relay] Authentication bypass in Relay plugin, protocols "api" and "weechat".
—
Fixed in version 4.9.4 ().
-
WSA-2026-8: [Relay] Buffer overflow in dump of Relay data.
—
Fixed in version 4.9.2 ().
-
WSA-2026-7: [Xfer] Buffer overflow when receiving a line in a Xfer chat (DCC chat) buffer.
—
Fixed in version 4.9.2 ().
-
WSA-2026-6: [Xfer] Write of DCC file received outside of configured download path.
—
Fixed in version 4.9.2 ().
-
WSA-2026-5: [IRC] Buffer overflow when receiving a DCC file.
—
Fixed in version 4.9.2 ().
-
WSA-2026-4: [Relay] Missing size limit for the received websocket frame, HTTP message and HTTP body.
—
Fixed in version 4.9.2 ().
-
WSA-2026-3: [IRC] Missing size limit for the unterminated IRC message or isupport value (message 005).
—
Fixed in version 4.9.2 ().
-
WSA-2026-2: [API, Relay] Non-constant time password/hash comparison.
—
Fixed in version 4.9.1 ().
-
WSA-2026-1: [Relay] Missing size limit for the decompressed websocket frame in relay plugin, protocol "api".
—
Fixed in version 4.9.1 ().
-
WSA-2025-7: [Core] Buffer overflow in range of chars in evaluated expressions.
—
Fixed in version 4.6.3 ().
-
WSA-2025-6: [Core] Buffer overflow in base 32 encoding in evaluated expressions.
—
Fixed in version 4.6.3 ().
-
WSA-2025-5: [Core] Buffer overflow in syntax highlighting of evaluated expressions.
—
Fixed in version 4.6.3 ().
-
WSA-2025-4: [Core] Buffer overflow in parsing of date/time.
—
Fixed in version 4.6.3 ().
-
WSA-2025-3: [Core] Integer overflow in conversion of version to an integer number.
—
Fixed in version 4.6.3 ().
-
WSA-2025-2: [Core] Integer overflow in base32 decode/encode functions.
—
Fixed in version 4.6.3 ().
-
WSA-2025-1: [Core] Integer overflow with decimal numbers in calculation of expression.
—
Fixed in version 4.6.3 ().
Affected by 38 vulnerabilities:
-
WSA-2026-32: [Relay] Denial of service with many passwords in command init received from a relay client.
—
Fixed in version 4.10.4 ().
-
WSA-2026-31: [Relay] Bypass of TOTP and denial of service with invalid TOTP received from a relay client.
—
Fixed in version 4.10.4 ().
-
WSA-2026-30: [Xfer] Incoming files and chats auto-accepted from a nick on the wrong server.
—
Fixed in version 4.10.3 ().
-
WSA-2026-29: [Relay] Missing check of the number of hash iterations received from a remote relay.
—
Fixed in version 4.10.3 ().
-
WSA-2026-28: [Xfer] Missing checks of the resume position received in DCC RESUME and DCC ACCEPT.
—
Fixed in version 4.10.3 ().
-
WSA-2026-27: [Relay] Denial of service with huge IRC messages received from a relay client.
—
Fixed in version 4.10.3 ().
-
WSA-2026-26: [IRC] Missing checks in SASL authentication with SCRAM mechanisms.
—
Fixed in version 4.10.3 ().
-
WSA-2026-25: [IRC] Evaluation of untrusted strings received from the IRC server or an IRC URL.
—
Fixed in version 4.10.2 ().
-
WSA-2026-24: [Relay] Missing size limit for HTTP headers received from a client.
—
Fixed in version 4.10.2 ().
-
WSA-2026-23: [Core] Heap buffer overflow in charset conversion.
—
Fixed in version 4.10.2 ().
-
WSA-2026-22: [Relay] Heap buffer overflow in path of hdata sent to clients with "weechat" protocol.
—
Fixed in version 4.10.2 ().
-
WSA-2026-21: [IRC] Heap buffer overflow in nick prefixes after a reconnection.
—
Fixed in version 4.10.2 ().
-
WSA-2026-20: [Relay] Missing size limit of data queued for sending to clients.
—
Fixed in version 4.10.1 ().
-
WSA-2026-19: [Relay] Missing rejection of invalid websocket frames.
—
Fixed in version 4.10.1 ().
-
WSA-2026-18: [Relay] Missing size limit for the unterminated Relay text message received from a client.
—
Fixed in version 4.10.1 ().
-
WSA-2026-17: [Xfer] Bypass of user authorization for start of DCC file transfer.
—
Fixed in version 4.10.1 ().
-
WSA-2026-16: [Xfer] Missing size limit for the unterminated Xfer chat message.
—
Fixed in version 4.10.1 ().
-
WSA-2026-15: [Xfer] Write of DCC file received outside of configured download path.
—
Fixed in version 4.10.1 ().
-
WSA-2026-14: [Relay] Use-after-free and double free when a remote relay sends an event with an array as body.
—
Fixed in version 4.9.5 ().
-
WSA-2026-13: [IRC] Use-after-free in the irc plugin when a batched message disconnects the server.
—
Fixed in version 4.9.5 ().
-
WSA-2026-12: [IRC] Stack buffer overflow when building a JOIN command with channel keys.
—
Fixed in version 4.9.5 ().
-
WSA-2026-11: [Logger] Write of logger file outside of configured path.
—
Fixed in version 4.9.4 ().
-
WSA-2026-10: [Relay] Authentication bypass in Relay plugin, protocols "api" and "weechat".
—
Fixed in version 4.9.4 ().
-
WSA-2026-8: [Relay] Buffer overflow in dump of Relay data.
—
Fixed in version 4.9.2 ().
-
WSA-2026-7: [Xfer] Buffer overflow when receiving a line in a Xfer chat (DCC chat) buffer.
—
Fixed in version 4.9.2 ().
-
WSA-2026-6: [Xfer] Write of DCC file received outside of configured download path.
—
Fixed in version 4.9.2 ().
-
WSA-2026-5: [IRC] Buffer overflow when receiving a DCC file.
—
Fixed in version 4.9.2 ().
-
WSA-2026-4: [Relay] Missing size limit for the received websocket frame, HTTP message and HTTP body.
—
Fixed in version 4.9.2 ().
-
WSA-2026-3: [IRC] Missing size limit for the unterminated IRC message or isupport value (message 005).
—
Fixed in version 4.9.2 ().
-
WSA-2026-2: [API, Relay] Non-constant time password/hash comparison.
—
Fixed in version 4.9.1 ().
-
WSA-2026-1: [Relay] Missing size limit for the decompressed websocket frame in relay plugin, protocol "api".
—
Fixed in version 4.9.1 ().
-
WSA-2025-7: [Core] Buffer overflow in range of chars in evaluated expressions.
—
Fixed in version 4.6.3 ().
-
WSA-2025-6: [Core] Buffer overflow in base 32 encoding in evaluated expressions.
—
Fixed in version 4.6.3 ().
-
WSA-2025-5: [Core] Buffer overflow in syntax highlighting of evaluated expressions.
—
Fixed in version 4.6.3 ().
-
WSA-2025-4: [Core] Buffer overflow in parsing of date/time.
—
Fixed in version 4.6.3 ().
-
WSA-2025-3: [Core] Integer overflow in conversion of version to an integer number.
—
Fixed in version 4.6.3 ().
-
WSA-2025-2: [Core] Integer overflow in base32 decode/encode functions.
—
Fixed in version 4.6.3 ().
-
WSA-2025-1: [Core] Integer overflow with decimal numbers in calculation of expression.
—
Fixed in version 4.6.3 ().
Affected by 39 vulnerabilities:
-
WSA-2026-32: [Relay] Denial of service with many passwords in command init received from a relay client.
—
Fixed in version 4.10.4 ().
-
WSA-2026-31: [Relay] Bypass of TOTP and denial of service with invalid TOTP received from a relay client.
—
Fixed in version 4.10.4 ().
-
WSA-2026-30: [Xfer] Incoming files and chats auto-accepted from a nick on the wrong server.
—
Fixed in version 4.10.3 ().
-
WSA-2026-29: [Relay] Missing check of the number of hash iterations received from a remote relay.
—
Fixed in version 4.10.3 ().
-
WSA-2026-28: [Xfer] Missing checks of the resume position received in DCC RESUME and DCC ACCEPT.
—
Fixed in version 4.10.3 ().
-
WSA-2026-27: [Relay] Denial of service with huge IRC messages received from a relay client.
—
Fixed in version 4.10.3 ().
-
WSA-2026-26: [IRC] Missing checks in SASL authentication with SCRAM mechanisms.
—
Fixed in version 4.10.3 ().
-
WSA-2026-25: [IRC] Evaluation of untrusted strings received from the IRC server or an IRC URL.
—
Fixed in version 4.10.2 ().
-
WSA-2026-24: [Relay] Missing size limit for HTTP headers received from a client.
—
Fixed in version 4.10.2 ().
-
WSA-2026-23: [Core] Heap buffer overflow in charset conversion.
—
Fixed in version 4.10.2 ().
-
WSA-2026-22: [Relay] Heap buffer overflow in path of hdata sent to clients with "weechat" protocol.
—
Fixed in version 4.10.2 ().
-
WSA-2026-21: [IRC] Heap buffer overflow in nick prefixes after a reconnection.
—
Fixed in version 4.10.2 ().
-
WSA-2026-20: [Relay] Missing size limit of data queued for sending to clients.
—
Fixed in version 4.10.1 ().
-
WSA-2026-19: [Relay] Missing rejection of invalid websocket frames.
—
Fixed in version 4.10.1 ().
-
WSA-2026-18: [Relay] Missing size limit for the unterminated Relay text message received from a client.
—
Fixed in version 4.10.1 ().
-
WSA-2026-17: [Xfer] Bypass of user authorization for start of DCC file transfer.
—
Fixed in version 4.10.1 ().
-
WSA-2026-16: [Xfer] Missing size limit for the unterminated Xfer chat message.
—
Fixed in version 4.10.1 ().
-
WSA-2026-15: [Xfer] Write of DCC file received outside of configured download path.
—
Fixed in version 4.10.1 ().
-
WSA-2026-14: [Relay] Use-after-free and double free when a remote relay sends an event with an array as body.
—
Fixed in version 4.9.5 ().
-
WSA-2026-13: [IRC] Use-after-free in the irc plugin when a batched message disconnects the server.
—
Fixed in version 4.9.5 ().
-
WSA-2026-12: [IRC] Stack buffer overflow when building a JOIN command with channel keys.
—
Fixed in version 4.9.5 ().
-
WSA-2026-11: [Logger] Write of logger file outside of configured path.
—
Fixed in version 4.9.4 ().
-
WSA-2026-10: [Relay] Authentication bypass in Relay plugin, protocols "api" and "weechat".
—
Fixed in version 4.9.4 ().
-
WSA-2026-8: [Relay] Buffer overflow in dump of Relay data.
—
Fixed in version 4.9.2 ().
-
WSA-2026-7: [Xfer] Buffer overflow when receiving a line in a Xfer chat (DCC chat) buffer.
—
Fixed in version 4.9.2 ().
-
WSA-2026-6: [Xfer] Write of DCC file received outside of configured download path.
—
Fixed in version 4.9.2 ().
-
WSA-2026-5: [IRC] Buffer overflow when receiving a DCC file.
—
Fixed in version 4.9.2 ().
-
WSA-2026-4: [Relay] Missing size limit for the received websocket frame, HTTP message and HTTP body.
—
Fixed in version 4.9.2 ().
-
WSA-2026-3: [IRC] Missing size limit for the unterminated IRC message or isupport value (message 005).
—
Fixed in version 4.9.2 ().
-
WSA-2026-2: [API, Relay] Non-constant time password/hash comparison.
—
Fixed in version 4.9.1 ().
-
WSA-2026-1: [Relay] Missing size limit for the decompressed websocket frame in relay plugin, protocol "api".
—
Fixed in version 4.9.1 ().
-
WSA-2025-7: [Core] Buffer overflow in range of chars in evaluated expressions.
—
Fixed in version 4.6.3 ().
-
WSA-2025-6: [Core] Buffer overflow in base 32 encoding in evaluated expressions.
—
Fixed in version 4.6.3 ().
-
WSA-2025-5: [Core] Buffer overflow in syntax highlighting of evaluated expressions.
—
Fixed in version 4.6.3 ().
-
WSA-2025-4: [Core] Buffer overflow in parsing of date/time.
—
Fixed in version 4.6.3 ().
-
WSA-2025-3: [Core] Integer overflow in conversion of version to an integer number.
—
Fixed in version 4.6.3 ().
-
WSA-2025-2: [Core] Integer overflow in base32 decode/encode functions.
—
Fixed in version 4.6.3 ().
-
WSA-2025-1: [Core] Integer overflow with decimal numbers in calculation of expression.
—
Fixed in version 4.6.3 ().
-
WSA-2024-1: [Core, Plugins] Integer overflow in loops on lists.
—
Fixed in version 4.4.2 ().
Affected by 39 vulnerabilities:
-
WSA-2026-32: [Relay] Denial of service with many passwords in command init received from a relay client.
—
Fixed in version 4.10.4 ().
-
WSA-2026-31: [Relay] Bypass of TOTP and denial of service with invalid TOTP received from a relay client.
—
Fixed in version 4.10.4 ().
-
WSA-2026-30: [Xfer] Incoming files and chats auto-accepted from a nick on the wrong server.
—
Fixed in version 4.10.3 ().
-
WSA-2026-29: [Relay] Missing check of the number of hash iterations received from a remote relay.
—
Fixed in version 4.10.3 ().
-
WSA-2026-28: [Xfer] Missing checks of the resume position received in DCC RESUME and DCC ACCEPT.
—
Fixed in version 4.10.3 ().
-
WSA-2026-27: [Relay] Denial of service with huge IRC messages received from a relay client.
—
Fixed in version 4.10.3 ().
-
WSA-2026-26: [IRC] Missing checks in SASL authentication with SCRAM mechanisms.
—
Fixed in version 4.10.3 ().
-
WSA-2026-25: [IRC] Evaluation of untrusted strings received from the IRC server or an IRC URL.
—
Fixed in version 4.10.2 ().
-
WSA-2026-24: [Relay] Missing size limit for HTTP headers received from a client.
—
Fixed in version 4.10.2 ().
-
WSA-2026-23: [Core] Heap buffer overflow in charset conversion.
—
Fixed in version 4.10.2 ().
-
WSA-2026-22: [Relay] Heap buffer overflow in path of hdata sent to clients with "weechat" protocol.
—
Fixed in version 4.10.2 ().
-
WSA-2026-21: [IRC] Heap buffer overflow in nick prefixes after a reconnection.
—
Fixed in version 4.10.2 ().
-
WSA-2026-20: [Relay] Missing size limit of data queued for sending to clients.
—
Fixed in version 4.10.1 ().
-
WSA-2026-19: [Relay] Missing rejection of invalid websocket frames.
—
Fixed in version 4.10.1 ().
-
WSA-2026-18: [Relay] Missing size limit for the unterminated Relay text message received from a client.
—
Fixed in version 4.10.1 ().
-
WSA-2026-17: [Xfer] Bypass of user authorization for start of DCC file transfer.
—
Fixed in version 4.10.1 ().
-
WSA-2026-16: [Xfer] Missing size limit for the unterminated Xfer chat message.
—
Fixed in version 4.10.1 ().
-
WSA-2026-15: [Xfer] Write of DCC file received outside of configured download path.
—
Fixed in version 4.10.1 ().
-
WSA-2026-14: [Relay] Use-after-free and double free when a remote relay sends an event with an array as body.
—
Fixed in version 4.9.5 ().
-
WSA-2026-13: [IRC] Use-after-free in the irc plugin when a batched message disconnects the server.
—
Fixed in version 4.9.5 ().
-
WSA-2026-12: [IRC] Stack buffer overflow when building a JOIN command with channel keys.
—
Fixed in version 4.9.5 ().
-
WSA-2026-11: [Logger] Write of logger file outside of configured path.
—
Fixed in version 4.9.4 ().
-
WSA-2026-10: [Relay] Authentication bypass in Relay plugin, protocols "api" and "weechat".
—
Fixed in version 4.9.4 ().
-
WSA-2026-8: [Relay] Buffer overflow in dump of Relay data.
—
Fixed in version 4.9.2 ().
-
WSA-2026-7: [Xfer] Buffer overflow when receiving a line in a Xfer chat (DCC chat) buffer.
—
Fixed in version 4.9.2 ().
-
WSA-2026-6: [Xfer] Write of DCC file received outside of configured download path.
—
Fixed in version 4.9.2 ().
-
WSA-2026-5: [IRC] Buffer overflow when receiving a DCC file.
—
Fixed in version 4.9.2 ().
-
WSA-2026-4: [Relay] Missing size limit for the received websocket frame, HTTP message and HTTP body.
—
Fixed in version 4.9.2 ().
-
WSA-2026-3: [IRC] Missing size limit for the unterminated IRC message or isupport value (message 005).
—
Fixed in version 4.9.2 ().
-
WSA-2026-2: [API, Relay] Non-constant time password/hash comparison.
—
Fixed in version 4.9.1 ().
-
WSA-2026-1: [Relay] Missing size limit for the decompressed websocket frame in relay plugin, protocol "api".
—
Fixed in version 4.9.1 ().
-
WSA-2025-7: [Core] Buffer overflow in range of chars in evaluated expressions.
—
Fixed in version 4.6.3 ().
-
WSA-2025-6: [Core] Buffer overflow in base 32 encoding in evaluated expressions.
—
Fixed in version 4.6.3 ().
-
WSA-2025-5: [Core] Buffer overflow in syntax highlighting of evaluated expressions.
—
Fixed in version 4.6.3 ().
-
WSA-2025-4: [Core] Buffer overflow in parsing of date/time.
—
Fixed in version 4.6.3 ().
-
WSA-2025-3: [Core] Integer overflow in conversion of version to an integer number.
—
Fixed in version 4.6.3 ().
-
WSA-2025-2: [Core] Integer overflow in base32 decode/encode functions.
—
Fixed in version 4.6.3 ().
-
WSA-2025-1: [Core] Integer overflow with decimal numbers in calculation of expression.
—
Fixed in version 4.6.3 ().
-
WSA-2024-1: [Core, Plugins] Integer overflow in loops on lists.
—
Fixed in version 4.4.2 ().
Affected by 39 vulnerabilities:
-
WSA-2026-32: [Relay] Denial of service with many passwords in command init received from a relay client.
—
Fixed in version 4.10.4 ().
-
WSA-2026-31: [Relay] Bypass of TOTP and denial of service with invalid TOTP received from a relay client.
—
Fixed in version 4.10.4 ().
-
WSA-2026-30: [Xfer] Incoming files and chats auto-accepted from a nick on the wrong server.
—
Fixed in version 4.10.3 ().
-
WSA-2026-29: [Relay] Missing check of the number of hash iterations received from a remote relay.
—
Fixed in version 4.10.3 ().
-
WSA-2026-28: [Xfer] Missing checks of the resume position received in DCC RESUME and DCC ACCEPT.
—
Fixed in version 4.10.3 ().
-
WSA-2026-27: [Relay] Denial of service with huge IRC messages received from a relay client.
—
Fixed in version 4.10.3 ().
-
WSA-2026-26: [IRC] Missing checks in SASL authentication with SCRAM mechanisms.
—
Fixed in version 4.10.3 ().
-
WSA-2026-25: [IRC] Evaluation of untrusted strings received from the IRC server or an IRC URL.
—
Fixed in version 4.10.2 ().
-
WSA-2026-24: [Relay] Missing size limit for HTTP headers received from a client.
—
Fixed in version 4.10.2 ().
-
WSA-2026-23: [Core] Heap buffer overflow in charset conversion.
—
Fixed in version 4.10.2 ().
-
WSA-2026-22: [Relay] Heap buffer overflow in path of hdata sent to clients with "weechat" protocol.
—
Fixed in version 4.10.2 ().
-
WSA-2026-21: [IRC] Heap buffer overflow in nick prefixes after a reconnection.
—
Fixed in version 4.10.2 ().
-
WSA-2026-20: [Relay] Missing size limit of data queued for sending to clients.
—
Fixed in version 4.10.1 ().
-
WSA-2026-19: [Relay] Missing rejection of invalid websocket frames.
—
Fixed in version 4.10.1 ().
-
WSA-2026-18: [Relay] Missing size limit for the unterminated Relay text message received from a client.
—
Fixed in version 4.10.1 ().
-
WSA-2026-17: [Xfer] Bypass of user authorization for start of DCC file transfer.
—
Fixed in version 4.10.1 ().
-
WSA-2026-16: [Xfer] Missing size limit for the unterminated Xfer chat message.
—
Fixed in version 4.10.1 ().
-
WSA-2026-15: [Xfer] Write of DCC file received outside of configured download path.
—
Fixed in version 4.10.1 ().
-
WSA-2026-14: [Relay] Use-after-free and double free when a remote relay sends an event with an array as body.
—
Fixed in version 4.9.5 ().
-
WSA-2026-13: [IRC] Use-after-free in the irc plugin when a batched message disconnects the server.
—
Fixed in version 4.9.5 ().
-
WSA-2026-12: [IRC] Stack buffer overflow when building a JOIN command with channel keys.
—
Fixed in version 4.9.5 ().
-
WSA-2026-11: [Logger] Write of logger file outside of configured path.
—
Fixed in version 4.9.4 ().
-
WSA-2026-10: [Relay] Authentication bypass in Relay plugin, protocols "api" and "weechat".
—
Fixed in version 4.9.4 ().
-
WSA-2026-8: [Relay] Buffer overflow in dump of Relay data.
—
Fixed in version 4.9.2 ().
-
WSA-2026-7: [Xfer] Buffer overflow when receiving a line in a Xfer chat (DCC chat) buffer.
—
Fixed in version 4.9.2 ().
-
WSA-2026-6: [Xfer] Write of DCC file received outside of configured download path.
—
Fixed in version 4.9.2 ().
-
WSA-2026-5: [IRC] Buffer overflow when receiving a DCC file.
—
Fixed in version 4.9.2 ().
-
WSA-2026-4: [Relay] Missing size limit for the received websocket frame, HTTP message and HTTP body.
—
Fixed in version 4.9.2 ().
-
WSA-2026-3: [IRC] Missing size limit for the unterminated IRC message or isupport value (message 005).
—
Fixed in version 4.9.2 ().
-
WSA-2026-2: [API, Relay] Non-constant time password/hash comparison.
—
Fixed in version 4.9.1 ().
-
WSA-2026-1: [Relay] Missing size limit for the decompressed websocket frame in relay plugin, protocol "api".
—
Fixed in version 4.9.1 ().
-
WSA-2025-7: [Core] Buffer overflow in range of chars in evaluated expressions.
—
Fixed in version 4.6.3 ().
-
WSA-2025-6: [Core] Buffer overflow in base 32 encoding in evaluated expressions.
—
Fixed in version 4.6.3 ().
-
WSA-2025-5: [Core] Buffer overflow in syntax highlighting of evaluated expressions.
—
Fixed in version 4.6.3 ().
-
WSA-2025-4: [Core] Buffer overflow in parsing of date/time.
—
Fixed in version 4.6.3 ().
-
WSA-2025-3: [Core] Integer overflow in conversion of version to an integer number.
—
Fixed in version 4.6.3 ().
-
WSA-2025-2: [Core] Integer overflow in base32 decode/encode functions.
—
Fixed in version 4.6.3 ().
-
WSA-2025-1: [Core] Integer overflow with decimal numbers in calculation of expression.
—
Fixed in version 4.6.3 ().
-
WSA-2024-1: [Core, Plugins] Integer overflow in loops on lists.
—
Fixed in version 4.4.2 ().
Affected by 39 vulnerabilities:
-
WSA-2026-32: [Relay] Denial of service with many passwords in command init received from a relay client.
—
Fixed in version 4.10.4 ().
-
WSA-2026-31: [Relay] Bypass of TOTP and denial of service with invalid TOTP received from a relay client.
—
Fixed in version 4.10.4 ().
-
WSA-2026-30: [Xfer] Incoming files and chats auto-accepted from a nick on the wrong server.
—
Fixed in version 4.10.3 ().
-
WSA-2026-29: [Relay] Missing check of the number of hash iterations received from a remote relay.
—
Fixed in version 4.10.3 ().
-
WSA-2026-28: [Xfer] Missing checks of the resume position received in DCC RESUME and DCC ACCEPT.
—
Fixed in version 4.10.3 ().
-
WSA-2026-27: [Relay] Denial of service with huge IRC messages received from a relay client.
—
Fixed in version 4.10.3 ().
-
WSA-2026-26: [IRC] Missing checks in SASL authentication with SCRAM mechanisms.
—
Fixed in version 4.10.3 ().
-
WSA-2026-25: [IRC] Evaluation of untrusted strings received from the IRC server or an IRC URL.
—
Fixed in version 4.10.2 ().
-
WSA-2026-24: [Relay] Missing size limit for HTTP headers received from a client.
—
Fixed in version 4.10.2 ().
-
WSA-2026-23: [Core] Heap buffer overflow in charset conversion.
—
Fixed in version 4.10.2 ().
-
WSA-2026-22: [Relay] Heap buffer overflow in path of hdata sent to clients with "weechat" protocol.
—
Fixed in version 4.10.2 ().
-
WSA-2026-21: [IRC] Heap buffer overflow in nick prefixes after a reconnection.
—
Fixed in version 4.10.2 ().
-
WSA-2026-20: [Relay] Missing size limit of data queued for sending to clients.
—
Fixed in version 4.10.1 ().
-
WSA-2026-19: [Relay] Missing rejection of invalid websocket frames.
—
Fixed in version 4.10.1 ().
-
WSA-2026-18: [Relay] Missing size limit for the unterminated Relay text message received from a client.
—
Fixed in version 4.10.1 ().
-
WSA-2026-17: [Xfer] Bypass of user authorization for start of DCC file transfer.
—
Fixed in version 4.10.1 ().
-
WSA-2026-16: [Xfer] Missing size limit for the unterminated Xfer chat message.
—
Fixed in version 4.10.1 ().
-
WSA-2026-15: [Xfer] Write of DCC file received outside of configured download path.
—
Fixed in version 4.10.1 ().
-
WSA-2026-14: [Relay] Use-after-free and double free when a remote relay sends an event with an array as body.
—
Fixed in version 4.9.5 ().
-
WSA-2026-13: [IRC] Use-after-free in the irc plugin when a batched message disconnects the server.
—
Fixed in version 4.9.5 ().
-
WSA-2026-12: [IRC] Stack buffer overflow when building a JOIN command with channel keys.
—
Fixed in version 4.9.5 ().
-
WSA-2026-11: [Logger] Write of logger file outside of configured path.
—
Fixed in version 4.9.4 ().
-
WSA-2026-10: [Relay] Authentication bypass in Relay plugin, protocols "api" and "weechat".
—
Fixed in version 4.9.4 ().
-
WSA-2026-8: [Relay] Buffer overflow in dump of Relay data.
—
Fixed in version 4.9.2 ().
-
WSA-2026-7: [Xfer] Buffer overflow when receiving a line in a Xfer chat (DCC chat) buffer.
—
Fixed in version 4.9.2 ().
-
WSA-2026-6: [Xfer] Write of DCC file received outside of configured download path.
—
Fixed in version 4.9.2 ().
-
WSA-2026-5: [IRC] Buffer overflow when receiving a DCC file.
—
Fixed in version 4.9.2 ().
-
WSA-2026-4: [Relay] Missing size limit for the received websocket frame, HTTP message and HTTP body.
—
Fixed in version 4.9.2 ().
-
WSA-2026-3: [IRC] Missing size limit for the unterminated IRC message or isupport value (message 005).
—
Fixed in version 4.9.2 ().
-
WSA-2026-2: [API, Relay] Non-constant time password/hash comparison.
—
Fixed in version 4.9.1 ().
-
WSA-2026-1: [Relay] Missing size limit for the decompressed websocket frame in relay plugin, protocol "api".
—
Fixed in version 4.9.1 ().
-
WSA-2025-7: [Core] Buffer overflow in range of chars in evaluated expressions.
—
Fixed in version 4.6.3 ().
-
WSA-2025-6: [Core] Buffer overflow in base 32 encoding in evaluated expressions.
—
Fixed in version 4.6.3 ().
-
WSA-2025-5: [Core] Buffer overflow in syntax highlighting of evaluated expressions.
—
Fixed in version 4.6.3 ().
-
WSA-2025-4: [Core] Buffer overflow in parsing of date/time.
—
Fixed in version 4.6.3 ().
-
WSA-2025-3: [Core] Integer overflow in conversion of version to an integer number.
—
Fixed in version 4.6.3 ().
-
WSA-2025-2: [Core] Integer overflow in base32 decode/encode functions.
—
Fixed in version 4.6.3 ().
-
WSA-2025-1: [Core] Integer overflow with decimal numbers in calculation of expression.
—
Fixed in version 4.6.3 ().
-
WSA-2024-1: [Core, Plugins] Integer overflow in loops on lists.
—
Fixed in version 4.4.2 ().
Affected by 39 vulnerabilities:
-
WSA-2026-32: [Relay] Denial of service with many passwords in command init received from a relay client.
—
Fixed in version 4.10.4 ().
-
WSA-2026-31: [Relay] Bypass of TOTP and denial of service with invalid TOTP received from a relay client.
—
Fixed in version 4.10.4 ().
-
WSA-2026-30: [Xfer] Incoming files and chats auto-accepted from a nick on the wrong server.
—
Fixed in version 4.10.3 ().
-
WSA-2026-29: [Relay] Missing check of the number of hash iterations received from a remote relay.
—
Fixed in version 4.10.3 ().
-
WSA-2026-28: [Xfer] Missing checks of the resume position received in DCC RESUME and DCC ACCEPT.
—
Fixed in version 4.10.3 ().
-
WSA-2026-27: [Relay] Denial of service with huge IRC messages received from a relay client.
—
Fixed in version 4.10.3 ().
-
WSA-2026-26: [IRC] Missing checks in SASL authentication with SCRAM mechanisms.
—
Fixed in version 4.10.3 ().
-
WSA-2026-25: [IRC] Evaluation of untrusted strings received from the IRC server or an IRC URL.
—
Fixed in version 4.10.2 ().
-
WSA-2026-24: [Relay] Missing size limit for HTTP headers received from a client.
—
Fixed in version 4.10.2 ().
-
WSA-2026-23: [Core] Heap buffer overflow in charset conversion.
—
Fixed in version 4.10.2 ().
-
WSA-2026-22: [Relay] Heap buffer overflow in path of hdata sent to clients with "weechat" protocol.
—
Fixed in version 4.10.2 ().
-
WSA-2026-21: [IRC] Heap buffer overflow in nick prefixes after a reconnection.
—
Fixed in version 4.10.2 ().
-
WSA-2026-20: [Relay] Missing size limit of data queued for sending to clients.
—
Fixed in version 4.10.1 ().
-
WSA-2026-19: [Relay] Missing rejection of invalid websocket frames.
—
Fixed in version 4.10.1 ().
-
WSA-2026-18: [Relay] Missing size limit for the unterminated Relay text message received from a client.
—
Fixed in version 4.10.1 ().
-
WSA-2026-17: [Xfer] Bypass of user authorization for start of DCC file transfer.
—
Fixed in version 4.10.1 ().
-
WSA-2026-16: [Xfer] Missing size limit for the unterminated Xfer chat message.
—
Fixed in version 4.10.1 ().
-
WSA-2026-15: [Xfer] Write of DCC file received outside of configured download path.
—
Fixed in version 4.10.1 ().
-
WSA-2026-14: [Relay] Use-after-free and double free when a remote relay sends an event with an array as body.
—
Fixed in version 4.9.5 ().
-
WSA-2026-13: [IRC] Use-after-free in the irc plugin when a batched message disconnects the server.
—
Fixed in version 4.9.5 ().
-
WSA-2026-12: [IRC] Stack buffer overflow when building a JOIN command with channel keys.
—
Fixed in version 4.9.5 ().
-
WSA-2026-11: [Logger] Write of logger file outside of configured path.
—
Fixed in version 4.9.4 ().
-
WSA-2026-10: [Relay] Authentication bypass in Relay plugin, protocols "api" and "weechat".
—
Fixed in version 4.9.4 ().
-
WSA-2026-8: [Relay] Buffer overflow in dump of Relay data.
—
Fixed in version 4.9.2 ().
-
WSA-2026-7: [Xfer] Buffer overflow when receiving a line in a Xfer chat (DCC chat) buffer.
—
Fixed in version 4.9.2 ().
-
WSA-2026-6: [Xfer] Write of DCC file received outside of configured download path.
—
Fixed in version 4.9.2 ().
-
WSA-2026-5: [IRC] Buffer overflow when receiving a DCC file.
—
Fixed in version 4.9.2 ().
-
WSA-2026-4: [Relay] Missing size limit for the received websocket frame, HTTP message and HTTP body.
—
Fixed in version 4.9.2 ().
-
WSA-2026-3: [IRC] Missing size limit for the unterminated IRC message or isupport value (message 005).
—
Fixed in version 4.9.2 ().
-
WSA-2026-2: [API, Relay] Non-constant time password/hash comparison.
—
Fixed in version 4.9.1 ().
-
WSA-2026-1: [Relay] Missing size limit for the decompressed websocket frame in relay plugin, protocol "api".
—
Fixed in version 4.9.1 ().
-
WSA-2025-7: [Core] Buffer overflow in range of chars in evaluated expressions.
—
Fixed in version 4.6.3 ().
-
WSA-2025-6: [Core] Buffer overflow in base 32 encoding in evaluated expressions.
—
Fixed in version 4.6.3 ().
-
WSA-2025-5: [Core] Buffer overflow in syntax highlighting of evaluated expressions.
—
Fixed in version 4.6.3 ().
-
WSA-2025-4: [Core] Buffer overflow in parsing of date/time.
—
Fixed in version 4.6.3 ().
-
WSA-2025-3: [Core] Integer overflow in conversion of version to an integer number.
—
Fixed in version 4.6.3 ().
-
WSA-2025-2: [Core] Integer overflow in base32 decode/encode functions.
—
Fixed in version 4.6.3 ().
-
WSA-2025-1: [Core] Integer overflow with decimal numbers in calculation of expression.
—
Fixed in version 4.6.3 ().
-
WSA-2024-1: [Core, Plugins] Integer overflow in loops on lists.
—
Fixed in version 4.4.2 ().
Affected by 39 vulnerabilities:
-
WSA-2026-32: [Relay] Denial of service with many passwords in command init received from a relay client.
—
Fixed in version 4.10.4 ().
-
WSA-2026-31: [Relay] Bypass of TOTP and denial of service with invalid TOTP received from a relay client.
—
Fixed in version 4.10.4 ().
-
WSA-2026-30: [Xfer] Incoming files and chats auto-accepted from a nick on the wrong server.
—
Fixed in version 4.10.3 ().
-
WSA-2026-29: [Relay] Missing check of the number of hash iterations received from a remote relay.
—
Fixed in version 4.10.3 ().
-
WSA-2026-28: [Xfer] Missing checks of the resume position received in DCC RESUME and DCC ACCEPT.
—
Fixed in version 4.10.3 ().
-
WSA-2026-27: [Relay] Denial of service with huge IRC messages received from a relay client.
—
Fixed in version 4.10.3 ().
-
WSA-2026-26: [IRC] Missing checks in SASL authentication with SCRAM mechanisms.
—
Fixed in version 4.10.3 ().
-
WSA-2026-25: [IRC] Evaluation of untrusted strings received from the IRC server or an IRC URL.
—
Fixed in version 4.10.2 ().
-
WSA-2026-24: [Relay] Missing size limit for HTTP headers received from a client.
—
Fixed in version 4.10.2 ().
-
WSA-2026-23: [Core] Heap buffer overflow in charset conversion.
—
Fixed in version 4.10.2 ().
-
WSA-2026-22: [Relay] Heap buffer overflow in path of hdata sent to clients with "weechat" protocol.
—
Fixed in version 4.10.2 ().
-
WSA-2026-21: [IRC] Heap buffer overflow in nick prefixes after a reconnection.
—
Fixed in version 4.10.2 ().
-
WSA-2026-20: [Relay] Missing size limit of data queued for sending to clients.
—
Fixed in version 4.10.1 ().
-
WSA-2026-19: [Relay] Missing rejection of invalid websocket frames.
—
Fixed in version 4.10.1 ().
-
WSA-2026-18: [Relay] Missing size limit for the unterminated Relay text message received from a client.
—
Fixed in version 4.10.1 ().
-
WSA-2026-17: [Xfer] Bypass of user authorization for start of DCC file transfer.
—
Fixed in version 4.10.1 ().
-
WSA-2026-16: [Xfer] Missing size limit for the unterminated Xfer chat message.
—
Fixed in version 4.10.1 ().
-
WSA-2026-15: [Xfer] Write of DCC file received outside of configured download path.
—
Fixed in version 4.10.1 ().
-
WSA-2026-14: [Relay] Use-after-free and double free when a remote relay sends an event with an array as body.
—
Fixed in version 4.9.5 ().
-
WSA-2026-13: [IRC] Use-after-free in the irc plugin when a batched message disconnects the server.
—
Fixed in version 4.9.5 ().
-
WSA-2026-12: [IRC] Stack buffer overflow when building a JOIN command with channel keys.
—
Fixed in version 4.9.5 ().
-
WSA-2026-11: [Logger] Write of logger file outside of configured path.
—
Fixed in version 4.9.4 ().
-
WSA-2026-10: [Relay] Authentication bypass in Relay plugin, protocols "api" and "weechat".
—
Fixed in version 4.9.4 ().
-
WSA-2026-8: [Relay] Buffer overflow in dump of Relay data.
—
Fixed in version 4.9.2 ().
-
WSA-2026-7: [Xfer] Buffer overflow when receiving a line in a Xfer chat (DCC chat) buffer.
—
Fixed in version 4.9.2 ().
-
WSA-2026-6: [Xfer] Write of DCC file received outside of configured download path.
—
Fixed in version 4.9.2 ().
-
WSA-2026-5: [IRC] Buffer overflow when receiving a DCC file.
—
Fixed in version 4.9.2 ().
-
WSA-2026-4: [Relay] Missing size limit for the received websocket frame, HTTP message and HTTP body.
—
Fixed in version 4.9.2 ().
-
WSA-2026-3: [IRC] Missing size limit for the unterminated IRC message or isupport value (message 005).
—
Fixed in version 4.9.2 ().
-
WSA-2026-2: [API, Relay] Non-constant time password/hash comparison.
—
Fixed in version 4.9.1 ().
-
WSA-2026-1: [Relay] Missing size limit for the decompressed websocket frame in relay plugin, protocol "api".
—
Fixed in version 4.9.1 ().
-
WSA-2025-7: [Core] Buffer overflow in range of chars in evaluated expressions.
—
Fixed in version 4.6.3 ().
-
WSA-2025-6: [Core] Buffer overflow in base 32 encoding in evaluated expressions.
—
Fixed in version 4.6.3 ().
-
WSA-2025-5: [Core] Buffer overflow in syntax highlighting of evaluated expressions.
—
Fixed in version 4.6.3 ().
-
WSA-2025-4: [Core] Buffer overflow in parsing of date/time.
—
Fixed in version 4.6.3 ().
-
WSA-2025-3: [Core] Integer overflow in conversion of version to an integer number.
—
Fixed in version 4.6.3 ().
-
WSA-2025-2: [Core] Integer overflow in base32 decode/encode functions.
—
Fixed in version 4.6.3 ().
-
WSA-2025-1: [Core] Integer overflow with decimal numbers in calculation of expression.
—
Fixed in version 4.6.3 ().
-
WSA-2024-1: [Core, Plugins] Integer overflow in loops on lists.
—
Fixed in version 4.4.2 ().
Affected by 39 vulnerabilities:
-
WSA-2026-32: [Relay] Denial of service with many passwords in command init received from a relay client.
—
Fixed in version 4.10.4 ().
-
WSA-2026-31: [Relay] Bypass of TOTP and denial of service with invalid TOTP received from a relay client.
—
Fixed in version 4.10.4 ().
-
WSA-2026-30: [Xfer] Incoming files and chats auto-accepted from a nick on the wrong server.
—
Fixed in version 4.10.3 ().
-
WSA-2026-29: [Relay] Missing check of the number of hash iterations received from a remote relay.
—
Fixed in version 4.10.3 ().
-
WSA-2026-28: [Xfer] Missing checks of the resume position received in DCC RESUME and DCC ACCEPT.
—
Fixed in version 4.10.3 ().
-
WSA-2026-27: [Relay] Denial of service with huge IRC messages received from a relay client.
—
Fixed in version 4.10.3 ().
-
WSA-2026-26: [IRC] Missing checks in SASL authentication with SCRAM mechanisms.
—
Fixed in version 4.10.3 ().
-
WSA-2026-25: [IRC] Evaluation of untrusted strings received from the IRC server or an IRC URL.
—
Fixed in version 4.10.2 ().
-
WSA-2026-24: [Relay] Missing size limit for HTTP headers received from a client.
—
Fixed in version 4.10.2 ().
-
WSA-2026-23: [Core] Heap buffer overflow in charset conversion.
—
Fixed in version 4.10.2 ().
-
WSA-2026-22: [Relay] Heap buffer overflow in path of hdata sent to clients with "weechat" protocol.
—
Fixed in version 4.10.2 ().
-
WSA-2026-21: [IRC] Heap buffer overflow in nick prefixes after a reconnection.
—
Fixed in version 4.10.2 ().
-
WSA-2026-20: [Relay] Missing size limit of data queued for sending to clients.
—
Fixed in version 4.10.1 ().
-
WSA-2026-19: [Relay] Missing rejection of invalid websocket frames.
—
Fixed in version 4.10.1 ().
-
WSA-2026-18: [Relay] Missing size limit for the unterminated Relay text message received from a client.
—
Fixed in version 4.10.1 ().
-
WSA-2026-17: [Xfer] Bypass of user authorization for start of DCC file transfer.
—
Fixed in version 4.10.1 ().
-
WSA-2026-16: [Xfer] Missing size limit for the unterminated Xfer chat message.
—
Fixed in version 4.10.1 ().
-
WSA-2026-15: [Xfer] Write of DCC file received outside of configured download path.
—
Fixed in version 4.10.1 ().
-
WSA-2026-14: [Relay] Use-after-free and double free when a remote relay sends an event with an array as body.
—
Fixed in version 4.9.5 ().
-
WSA-2026-13: [IRC] Use-after-free in the irc plugin when a batched message disconnects the server.
—
Fixed in version 4.9.5 ().
-
WSA-2026-12: [IRC] Stack buffer overflow when building a JOIN command with channel keys.
—
Fixed in version 4.9.5 ().
-
WSA-2026-11: [Logger] Write of logger file outside of configured path.
—
Fixed in version 4.9.4 ().
-
WSA-2026-10: [Relay] Authentication bypass in Relay plugin, protocols "api" and "weechat".
—
Fixed in version 4.9.4 ().
-
WSA-2026-8: [Relay] Buffer overflow in dump of Relay data.
—
Fixed in version 4.9.2 ().
-
WSA-2026-7: [Xfer] Buffer overflow when receiving a line in a Xfer chat (DCC chat) buffer.
—
Fixed in version 4.9.2 ().
-
WSA-2026-6: [Xfer] Write of DCC file received outside of configured download path.
—
Fixed in version 4.9.2 ().
-
WSA-2026-5: [IRC] Buffer overflow when receiving a DCC file.
—
Fixed in version 4.9.2 ().
-
WSA-2026-4: [Relay] Missing size limit for the received websocket frame, HTTP message and HTTP body.
—
Fixed in version 4.9.2 ().
-
WSA-2026-3: [IRC] Missing size limit for the unterminated IRC message or isupport value (message 005).
—
Fixed in version 4.9.2 ().
-
WSA-2026-2: [API, Relay] Non-constant time password/hash comparison.
—
Fixed in version 4.9.1 ().
-
WSA-2026-1: [Relay] Missing size limit for the decompressed websocket frame in relay plugin, protocol "api".
—
Fixed in version 4.9.1 ().
-
WSA-2025-7: [Core] Buffer overflow in range of chars in evaluated expressions.
—
Fixed in version 4.6.3 ().
-
WSA-2025-6: [Core] Buffer overflow in base 32 encoding in evaluated expressions.
—
Fixed in version 4.6.3 ().
-
WSA-2025-5: [Core] Buffer overflow in syntax highlighting of evaluated expressions.
—
Fixed in version 4.6.3 ().
-
WSA-2025-4: [Core] Buffer overflow in parsing of date/time.
—
Fixed in version 4.6.3 ().
-
WSA-2025-3: [Core] Integer overflow in conversion of version to an integer number.
—
Fixed in version 4.6.3 ().
-
WSA-2025-2: [Core] Integer overflow in base32 decode/encode functions.
—
Fixed in version 4.6.3 ().
-
WSA-2025-1: [Core] Integer overflow with decimal numbers in calculation of expression.
—
Fixed in version 4.6.3 ().
-
WSA-2024-1: [Core, Plugins] Integer overflow in loops on lists.
—
Fixed in version 4.4.2 ().
Affected by 34 vulnerabilities:
-
WSA-2026-32: [Relay] Denial of service with many passwords in command init received from a relay client.
—
Fixed in version 4.10.4 ().
-
WSA-2026-31: [Relay] Bypass of TOTP and denial of service with invalid TOTP received from a relay client.
—
Fixed in version 4.10.4 ().
-
WSA-2026-30: [Xfer] Incoming files and chats auto-accepted from a nick on the wrong server.
—
Fixed in version 4.10.3 ().
-
WSA-2026-28: [Xfer] Missing checks of the resume position received in DCC RESUME and DCC ACCEPT.
—
Fixed in version 4.10.3 ().
-
WSA-2026-27: [Relay] Denial of service with huge IRC messages received from a relay client.
—
Fixed in version 4.10.3 ().
-
WSA-2026-26: [IRC] Missing checks in SASL authentication with SCRAM mechanisms.
—
Fixed in version 4.10.3 ().
-
WSA-2026-25: [IRC] Evaluation of untrusted strings received from the IRC server or an IRC URL.
—
Fixed in version 4.10.2 ().
-
WSA-2026-24: [Relay] Missing size limit for HTTP headers received from a client.
—
Fixed in version 4.10.2 ().
-
WSA-2026-23: [Core] Heap buffer overflow in charset conversion.
—
Fixed in version 4.10.2 ().
-
WSA-2026-22: [Relay] Heap buffer overflow in path of hdata sent to clients with "weechat" protocol.
—
Fixed in version 4.10.2 ().
-
WSA-2026-21: [IRC] Heap buffer overflow in nick prefixes after a reconnection.
—
Fixed in version 4.10.2 ().
-
WSA-2026-20: [Relay] Missing size limit of data queued for sending to clients.
—
Fixed in version 4.10.1 ().
-
WSA-2026-19: [Relay] Missing rejection of invalid websocket frames.
—
Fixed in version 4.10.1 ().
-
WSA-2026-18: [Relay] Missing size limit for the unterminated Relay text message received from a client.
—
Fixed in version 4.10.1 ().
-
WSA-2026-17: [Xfer] Bypass of user authorization for start of DCC file transfer.
—
Fixed in version 4.10.1 ().
-
WSA-2026-16: [Xfer] Missing size limit for the unterminated Xfer chat message.
—
Fixed in version 4.10.1 ().
-
WSA-2026-15: [Xfer] Write of DCC file received outside of configured download path.
—
Fixed in version 4.10.1 ().
-
WSA-2026-13: [IRC] Use-after-free in the irc plugin when a batched message disconnects the server.
—
Fixed in version 4.9.5 ().
-
WSA-2026-12: [IRC] Stack buffer overflow when building a JOIN command with channel keys.
—
Fixed in version 4.9.5 ().
-
WSA-2026-11: [Logger] Write of logger file outside of configured path.
—
Fixed in version 4.9.4 ().
-
WSA-2026-7: [Xfer] Buffer overflow when receiving a line in a Xfer chat (DCC chat) buffer.
—
Fixed in version 4.9.2 ().
-
WSA-2026-6: [Xfer] Write of DCC file received outside of configured download path.
—
Fixed in version 4.9.2 ().
-
WSA-2026-5: [IRC] Buffer overflow when receiving a DCC file.
—
Fixed in version 4.9.2 ().
-
WSA-2026-4: [Relay] Missing size limit for the received websocket frame, HTTP message and HTTP body.
—
Fixed in version 4.9.2 ().
-
WSA-2026-3: [IRC] Missing size limit for the unterminated IRC message or isupport value (message 005).
—
Fixed in version 4.9.2 ().
-
WSA-2026-2: [API, Relay] Non-constant time password/hash comparison.
—
Fixed in version 4.9.1 ().
-
WSA-2025-7: [Core] Buffer overflow in range of chars in evaluated expressions.
—
Fixed in version 4.6.3 ().
-
WSA-2025-6: [Core] Buffer overflow in base 32 encoding in evaluated expressions.
—
Fixed in version 4.6.3 ().
-
WSA-2025-5: [Core] Buffer overflow in syntax highlighting of evaluated expressions.
—
Fixed in version 4.6.3 ().
-
WSA-2025-4: [Core] Buffer overflow in parsing of date/time.
—
Fixed in version 4.6.3 ().
-
WSA-2025-3: [Core] Integer overflow in conversion of version to an integer number.
—
Fixed in version 4.6.3 ().
-
WSA-2025-2: [Core] Integer overflow in base32 decode/encode functions.
—
Fixed in version 4.6.3 ().
-
WSA-2025-1: [Core] Integer overflow with decimal numbers in calculation of expression.
—
Fixed in version 4.6.3 ().
-
WSA-2024-1: [Core, Plugins] Integer overflow in loops on lists.
—
Fixed in version 4.4.2 ().
Affected by 39 vulnerabilities:
-
WSA-2026-32: [Relay] Denial of service with many passwords in command init received from a relay client.
—
Fixed in version 4.10.4 ().
-
WSA-2026-31: [Relay] Bypass of TOTP and denial of service with invalid TOTP received from a relay client.
—
Fixed in version 4.10.4 ().
-
WSA-2026-30: [Xfer] Incoming files and chats auto-accepted from a nick on the wrong server.
—
Fixed in version 4.10.3 ().
-
WSA-2026-29: [Relay] Missing check of the number of hash iterations received from a remote relay.
—
Fixed in version 4.10.3 ().
-
WSA-2026-28: [Xfer] Missing checks of the resume position received in DCC RESUME and DCC ACCEPT.
—
Fixed in version 4.10.3 ().
-
WSA-2026-27: [Relay] Denial of service with huge IRC messages received from a relay client.
—
Fixed in version 4.10.3 ().
-
WSA-2026-26: [IRC] Missing checks in SASL authentication with SCRAM mechanisms.
—
Fixed in version 4.10.3 ().
-
WSA-2026-25: [IRC] Evaluation of untrusted strings received from the IRC server or an IRC URL.
—
Fixed in version 4.10.2 ().
-
WSA-2026-24: [Relay] Missing size limit for HTTP headers received from a client.
—
Fixed in version 4.10.2 ().
-
WSA-2026-23: [Core] Heap buffer overflow in charset conversion.
—
Fixed in version 4.10.2 ().
-
WSA-2026-22: [Relay] Heap buffer overflow in path of hdata sent to clients with "weechat" protocol.
—
Fixed in version 4.10.2 ().
-
WSA-2026-21: [IRC] Heap buffer overflow in nick prefixes after a reconnection.
—
Fixed in version 4.10.2 ().
-
WSA-2026-20: [Relay] Missing size limit of data queued for sending to clients.
—
Fixed in version 4.10.1 ().
-
WSA-2026-19: [Relay] Missing rejection of invalid websocket frames.
—
Fixed in version 4.10.1 ().
-
WSA-2026-18: [Relay] Missing size limit for the unterminated Relay text message received from a client.
—
Fixed in version 4.10.1 ().
-
WSA-2026-17: [Xfer] Bypass of user authorization for start of DCC file transfer.
—
Fixed in version 4.10.1 ().
-
WSA-2026-16: [Xfer] Missing size limit for the unterminated Xfer chat message.
—
Fixed in version 4.10.1 ().
-
WSA-2026-15: [Xfer] Write of DCC file received outside of configured download path.
—
Fixed in version 4.10.1 ().
-
WSA-2026-14: [Relay] Use-after-free and double free when a remote relay sends an event with an array as body.
—
Fixed in version 4.9.5 ().
-
WSA-2026-13: [IRC] Use-after-free in the irc plugin when a batched message disconnects the server.
—
Fixed in version 4.9.5 ().
-
WSA-2026-12: [IRC] Stack buffer overflow when building a JOIN command with channel keys.
—
Fixed in version 4.9.5 ().
-
WSA-2026-11: [Logger] Write of logger file outside of configured path.
—
Fixed in version 4.9.4 ().
-
WSA-2026-10: [Relay] Authentication bypass in Relay plugin, protocols "api" and "weechat".
—
Fixed in version 4.9.4 ().
-
WSA-2026-8: [Relay] Buffer overflow in dump of Relay data.
—
Fixed in version 4.9.2 ().
-
WSA-2026-7: [Xfer] Buffer overflow when receiving a line in a Xfer chat (DCC chat) buffer.
—
Fixed in version 4.9.2 ().
-
WSA-2026-6: [Xfer] Write of DCC file received outside of configured download path.
—
Fixed in version 4.9.2 ().
-
WSA-2026-5: [IRC] Buffer overflow when receiving a DCC file.
—
Fixed in version 4.9.2 ().
-
WSA-2026-4: [Relay] Missing size limit for the received websocket frame, HTTP message and HTTP body.
—
Fixed in version 4.9.2 ().
-
WSA-2026-3: [IRC] Missing size limit for the unterminated IRC message or isupport value (message 005).
—
Fixed in version 4.9.2 ().
-
WSA-2026-2: [API, Relay] Non-constant time password/hash comparison.
—
Fixed in version 4.9.1 ().
-
WSA-2026-1: [Relay] Missing size limit for the decompressed websocket frame in relay plugin, protocol "api".
—
Fixed in version 4.9.1 ().
-
WSA-2025-7: [Core] Buffer overflow in range of chars in evaluated expressions.
—
Fixed in version 4.6.3 ().
-
WSA-2025-6: [Core] Buffer overflow in base 32 encoding in evaluated expressions.
—
Fixed in version 4.6.3 ().
-
WSA-2025-5: [Core] Buffer overflow in syntax highlighting of evaluated expressions.
—
Fixed in version 4.6.3 ().
-
WSA-2025-4: [Core] Buffer overflow in parsing of date/time.
—
Fixed in version 4.6.3 ().
-
WSA-2025-3: [Core] Integer overflow in conversion of version to an integer number.
—
Fixed in version 4.6.3 ().
-
WSA-2025-2: [Core] Integer overflow in base32 decode/encode functions.
—
Fixed in version 4.6.3 ().
-
WSA-2025-1: [Core] Integer overflow with decimal numbers in calculation of expression.
—
Fixed in version 4.6.3 ().
-
WSA-2024-1: [Core, Plugins] Integer overflow in loops on lists.
—
Fixed in version 4.4.2 ().
Affected by 39 vulnerabilities:
-
WSA-2026-32: [Relay] Denial of service with many passwords in command init received from a relay client.
—
Fixed in version 4.10.4 ().
-
WSA-2026-31: [Relay] Bypass of TOTP and denial of service with invalid TOTP received from a relay client.
—
Fixed in version 4.10.4 ().
-
WSA-2026-30: [Xfer] Incoming files and chats auto-accepted from a nick on the wrong server.
—
Fixed in version 4.10.3 ().
-
WSA-2026-29: [Relay] Missing check of the number of hash iterations received from a remote relay.
—
Fixed in version 4.10.3 ().
-
WSA-2026-28: [Xfer] Missing checks of the resume position received in DCC RESUME and DCC ACCEPT.
—
Fixed in version 4.10.3 ().
-
WSA-2026-27: [Relay] Denial of service with huge IRC messages received from a relay client.
—
Fixed in version 4.10.3 ().
-
WSA-2026-26: [IRC] Missing checks in SASL authentication with SCRAM mechanisms.
—
Fixed in version 4.10.3 ().
-
WSA-2026-25: [IRC] Evaluation of untrusted strings received from the IRC server or an IRC URL.
—
Fixed in version 4.10.2 ().
-
WSA-2026-24: [Relay] Missing size limit for HTTP headers received from a client.
—
Fixed in version 4.10.2 ().
-
WSA-2026-23: [Core] Heap buffer overflow in charset conversion.
—
Fixed in version 4.10.2 ().
-
WSA-2026-22: [Relay] Heap buffer overflow in path of hdata sent to clients with "weechat" protocol.
—
Fixed in version 4.10.2 ().
-
WSA-2026-21: [IRC] Heap buffer overflow in nick prefixes after a reconnection.
—
Fixed in version 4.10.2 ().
-
WSA-2026-20: [Relay] Missing size limit of data queued for sending to clients.
—
Fixed in version 4.10.1 ().
-
WSA-2026-19: [Relay] Missing rejection of invalid websocket frames.
—
Fixed in version 4.10.1 ().
-
WSA-2026-18: [Relay] Missing size limit for the unterminated Relay text message received from a client.
—
Fixed in version 4.10.1 ().
-
WSA-2026-17: [Xfer] Bypass of user authorization for start of DCC file transfer.
—
Fixed in version 4.10.1 ().
-
WSA-2026-16: [Xfer] Missing size limit for the unterminated Xfer chat message.
—
Fixed in version 4.10.1 ().
-
WSA-2026-15: [Xfer] Write of DCC file received outside of configured download path.
—
Fixed in version 4.10.1 ().
-
WSA-2026-14: [Relay] Use-after-free and double free when a remote relay sends an event with an array as body.
—
Fixed in version 4.9.5 ().
-
WSA-2026-13: [IRC] Use-after-free in the irc plugin when a batched message disconnects the server.
—
Fixed in version 4.9.5 ().
-
WSA-2026-12: [IRC] Stack buffer overflow when building a JOIN command with channel keys.
—
Fixed in version 4.9.5 ().
-
WSA-2026-11: [Logger] Write of logger file outside of configured path.
—
Fixed in version 4.9.4 ().
-
WSA-2026-10: [Relay] Authentication bypass in Relay plugin, protocols "api" and "weechat".
—
Fixed in version 4.9.4 ().
-
WSA-2026-8: [Relay] Buffer overflow in dump of Relay data.
—
Fixed in version 4.9.2 ().
-
WSA-2026-7: [Xfer] Buffer overflow when receiving a line in a Xfer chat (DCC chat) buffer.
—
Fixed in version 4.9.2 ().
-
WSA-2026-6: [Xfer] Write of DCC file received outside of configured download path.
—
Fixed in version 4.9.2 ().
-
WSA-2026-5: [IRC] Buffer overflow when receiving a DCC file.
—
Fixed in version 4.9.2 ().
-
WSA-2026-4: [Relay] Missing size limit for the received websocket frame, HTTP message and HTTP body.
—
Fixed in version 4.9.2 ().
-
WSA-2026-3: [IRC] Missing size limit for the unterminated IRC message or isupport value (message 005).
—
Fixed in version 4.9.2 ().
-
WSA-2026-2: [API, Relay] Non-constant time password/hash comparison.
—
Fixed in version 4.9.1 ().
-
WSA-2026-1: [Relay] Missing size limit for the decompressed websocket frame in relay plugin, protocol "api".
—
Fixed in version 4.9.1 ().
-
WSA-2025-7: [Core] Buffer overflow in range of chars in evaluated expressions.
—
Fixed in version 4.6.3 ().
-
WSA-2025-6: [Core] Buffer overflow in base 32 encoding in evaluated expressions.
—
Fixed in version 4.6.3 ().
-
WSA-2025-5: [Core] Buffer overflow in syntax highlighting of evaluated expressions.
—
Fixed in version 4.6.3 ().
-
WSA-2025-4: [Core] Buffer overflow in parsing of date/time.
—
Fixed in version 4.6.3 ().
-
WSA-2025-3: [Core] Integer overflow in conversion of version to an integer number.
—
Fixed in version 4.6.3 ().
-
WSA-2025-2: [Core] Integer overflow in base32 decode/encode functions.
—
Fixed in version 4.6.3 ().
-
WSA-2025-1: [Core] Integer overflow with decimal numbers in calculation of expression.
—
Fixed in version 4.6.3 ().
-
WSA-2024-1: [Core, Plugins] Integer overflow in loops on lists.
—
Fixed in version 4.4.2 ().
Affected by 34 vulnerabilities:
-
WSA-2026-32: [Relay] Denial of service with many passwords in command init received from a relay client.
—
Fixed in version 4.10.4 ().
-
WSA-2026-31: [Relay] Bypass of TOTP and denial of service with invalid TOTP received from a relay client.
—
Fixed in version 4.10.4 ().
-
WSA-2026-30: [Xfer] Incoming files and chats auto-accepted from a nick on the wrong server.
—
Fixed in version 4.10.3 ().
-
WSA-2026-28: [Xfer] Missing checks of the resume position received in DCC RESUME and DCC ACCEPT.
—
Fixed in version 4.10.3 ().
-
WSA-2026-27: [Relay] Denial of service with huge IRC messages received from a relay client.
—
Fixed in version 4.10.3 ().
-
WSA-2026-26: [IRC] Missing checks in SASL authentication with SCRAM mechanisms.
—
Fixed in version 4.10.3 ().
-
WSA-2026-25: [IRC] Evaluation of untrusted strings received from the IRC server or an IRC URL.
—
Fixed in version 4.10.2 ().
-
WSA-2026-24: [Relay] Missing size limit for HTTP headers received from a client.
—
Fixed in version 4.10.2 ().
-
WSA-2026-23: [Core] Heap buffer overflow in charset conversion.
—
Fixed in version 4.10.2 ().
-
WSA-2026-22: [Relay] Heap buffer overflow in path of hdata sent to clients with "weechat" protocol.
—
Fixed in version 4.10.2 ().
-
WSA-2026-21: [IRC] Heap buffer overflow in nick prefixes after a reconnection.
—
Fixed in version 4.10.2 ().
-
WSA-2026-20: [Relay] Missing size limit of data queued for sending to clients.
—
Fixed in version 4.10.1 ().
-
WSA-2026-19: [Relay] Missing rejection of invalid websocket frames.
—
Fixed in version 4.10.1 ().
-
WSA-2026-18: [Relay] Missing size limit for the unterminated Relay text message received from a client.
—
Fixed in version 4.10.1 ().
-
WSA-2026-17: [Xfer] Bypass of user authorization for start of DCC file transfer.
—
Fixed in version 4.10.1 ().
-
WSA-2026-16: [Xfer] Missing size limit for the unterminated Xfer chat message.
—
Fixed in version 4.10.1 ().
-
WSA-2026-15: [Xfer] Write of DCC file received outside of configured download path.
—
Fixed in version 4.10.1 ().
-
WSA-2026-13: [IRC] Use-after-free in the irc plugin when a batched message disconnects the server.
—
Fixed in version 4.9.5 ().
-
WSA-2026-12: [IRC] Stack buffer overflow when building a JOIN command with channel keys.
—
Fixed in version 4.9.5 ().
-
WSA-2026-11: [Logger] Write of logger file outside of configured path.
—
Fixed in version 4.9.4 ().
-
WSA-2026-7: [Xfer] Buffer overflow when receiving a line in a Xfer chat (DCC chat) buffer.
—
Fixed in version 4.9.2 ().
-
WSA-2026-6: [Xfer] Write of DCC file received outside of configured download path.
—
Fixed in version 4.9.2 ().
-
WSA-2026-5: [IRC] Buffer overflow when receiving a DCC file.
—
Fixed in version 4.9.2 ().
-
WSA-2026-4: [Relay] Missing size limit for the received websocket frame, HTTP message and HTTP body.
—
Fixed in version 4.9.2 ().
-
WSA-2026-3: [IRC] Missing size limit for the unterminated IRC message or isupport value (message 005).
—
Fixed in version 4.9.2 ().
-
WSA-2026-2: [API, Relay] Non-constant time password/hash comparison.
—
Fixed in version 4.9.1 ().
-
WSA-2025-7: [Core] Buffer overflow in range of chars in evaluated expressions.
—
Fixed in version 4.6.3 ().
-
WSA-2025-6: [Core] Buffer overflow in base 32 encoding in evaluated expressions.
—
Fixed in version 4.6.3 ().
-
WSA-2025-5: [Core] Buffer overflow in syntax highlighting of evaluated expressions.
—
Fixed in version 4.6.3 ().
-
WSA-2025-4: [Core] Buffer overflow in parsing of date/time.
—
Fixed in version 4.6.3 ().
-
WSA-2025-3: [Core] Integer overflow in conversion of version to an integer number.
—
Fixed in version 4.6.3 ().
-
WSA-2025-2: [Core] Integer overflow in base32 decode/encode functions.
—
Fixed in version 4.6.3 ().
-
WSA-2025-1: [Core] Integer overflow with decimal numbers in calculation of expression.
—
Fixed in version 4.6.3 ().
-
WSA-2024-1: [Core, Plugins] Integer overflow in loops on lists.
—
Fixed in version 4.4.2 ().
Affected by 34 vulnerabilities:
-
WSA-2026-32: [Relay] Denial of service with many passwords in command init received from a relay client.
—
Fixed in version 4.10.4 ().
-
WSA-2026-31: [Relay] Bypass of TOTP and denial of service with invalid TOTP received from a relay client.
—
Fixed in version 4.10.4 ().
-
WSA-2026-30: [Xfer] Incoming files and chats auto-accepted from a nick on the wrong server.
—
Fixed in version 4.10.3 ().
-
WSA-2026-28: [Xfer] Missing checks of the resume position received in DCC RESUME and DCC ACCEPT.
—
Fixed in version 4.10.3 ().
-
WSA-2026-27: [Relay] Denial of service with huge IRC messages received from a relay client.
—
Fixed in version 4.10.3 ().
-
WSA-2026-26: [IRC] Missing checks in SASL authentication with SCRAM mechanisms.
—
Fixed in version 4.10.3 ().
-
WSA-2026-25: [IRC] Evaluation of untrusted strings received from the IRC server or an IRC URL.
—
Fixed in version 4.10.2 ().
-
WSA-2026-24: [Relay] Missing size limit for HTTP headers received from a client.
—
Fixed in version 4.10.2 ().
-
WSA-2026-23: [Core] Heap buffer overflow in charset conversion.
—
Fixed in version 4.10.2 ().
-
WSA-2026-22: [Relay] Heap buffer overflow in path of hdata sent to clients with "weechat" protocol.
—
Fixed in version 4.10.2 ().
-
WSA-2026-21: [IRC] Heap buffer overflow in nick prefixes after a reconnection.
—
Fixed in version 4.10.2 ().
-
WSA-2026-20: [Relay] Missing size limit of data queued for sending to clients.
—
Fixed in version 4.10.1 ().
-
WSA-2026-19: [Relay] Missing rejection of invalid websocket frames.
—
Fixed in version 4.10.1 ().
-
WSA-2026-18: [Relay] Missing size limit for the unterminated Relay text message received from a client.
—
Fixed in version 4.10.1 ().
-
WSA-2026-17: [Xfer] Bypass of user authorization for start of DCC file transfer.
—
Fixed in version 4.10.1 ().
-
WSA-2026-16: [Xfer] Missing size limit for the unterminated Xfer chat message.
—
Fixed in version 4.10.1 ().
-
WSA-2026-15: [Xfer] Write of DCC file received outside of configured download path.
—
Fixed in version 4.10.1 ().
-
WSA-2026-13: [IRC] Use-after-free in the irc plugin when a batched message disconnects the server.
—
Fixed in version 4.9.5 ().
-
WSA-2026-12: [IRC] Stack buffer overflow when building a JOIN command with channel keys.
—
Fixed in version 4.9.5 ().
-
WSA-2026-11: [Logger] Write of logger file outside of configured path.
—
Fixed in version 4.9.4 ().
-
WSA-2026-7: [Xfer] Buffer overflow when receiving a line in a Xfer chat (DCC chat) buffer.
—
Fixed in version 4.9.2 ().
-
WSA-2026-6: [Xfer] Write of DCC file received outside of configured download path.
—
Fixed in version 4.9.2 ().
-
WSA-2026-5: [IRC] Buffer overflow when receiving a DCC file.
—
Fixed in version 4.9.2 ().
-
WSA-2026-4: [Relay] Missing size limit for the received websocket frame, HTTP message and HTTP body.
—
Fixed in version 4.9.2 ().
-
WSA-2026-3: [IRC] Missing size limit for the unterminated IRC message or isupport value (message 005).
—
Fixed in version 4.9.2 ().
-
WSA-2026-2: [API, Relay] Non-constant time password/hash comparison.
—
Fixed in version 4.9.1 ().
-
WSA-2025-7: [Core] Buffer overflow in range of chars in evaluated expressions.
—
Fixed in version 4.6.3 ().
-
WSA-2025-6: [Core] Buffer overflow in base 32 encoding in evaluated expressions.
—
Fixed in version 4.6.3 ().
-
WSA-2025-5: [Core] Buffer overflow in syntax highlighting of evaluated expressions.
—
Fixed in version 4.6.3 ().
-
WSA-2025-4: [Core] Buffer overflow in parsing of date/time.
—
Fixed in version 4.6.3 ().
-
WSA-2025-3: [Core] Integer overflow in conversion of version to an integer number.
—
Fixed in version 4.6.3 ().
-
WSA-2025-2: [Core] Integer overflow in base32 decode/encode functions.
—
Fixed in version 4.6.3 ().
-
WSA-2025-1: [Core] Integer overflow with decimal numbers in calculation of expression.
—
Fixed in version 4.6.3 ().
-
WSA-2024-1: [Core, Plugins] Integer overflow in loops on lists.
—
Fixed in version 4.4.2 ().
Affected by 34 vulnerabilities:
-
WSA-2026-32: [Relay] Denial of service with many passwords in command init received from a relay client.
—
Fixed in version 4.10.4 ().
-
WSA-2026-31: [Relay] Bypass of TOTP and denial of service with invalid TOTP received from a relay client.
—
Fixed in version 4.10.4 ().
-
WSA-2026-30: [Xfer] Incoming files and chats auto-accepted from a nick on the wrong server.
—
Fixed in version 4.10.3 ().
-
WSA-2026-28: [Xfer] Missing checks of the resume position received in DCC RESUME and DCC ACCEPT.
—
Fixed in version 4.10.3 ().
-
WSA-2026-27: [Relay] Denial of service with huge IRC messages received from a relay client.
—
Fixed in version 4.10.3 ().
-
WSA-2026-26: [IRC] Missing checks in SASL authentication with SCRAM mechanisms.
—
Fixed in version 4.10.3 ().
-
WSA-2026-25: [IRC] Evaluation of untrusted strings received from the IRC server or an IRC URL.
—
Fixed in version 4.10.2 ().
-
WSA-2026-24: [Relay] Missing size limit for HTTP headers received from a client.
—
Fixed in version 4.10.2 ().
-
WSA-2026-23: [Core] Heap buffer overflow in charset conversion.
—
Fixed in version 4.10.2 ().
-
WSA-2026-22: [Relay] Heap buffer overflow in path of hdata sent to clients with "weechat" protocol.
—
Fixed in version 4.10.2 ().
-
WSA-2026-21: [IRC] Heap buffer overflow in nick prefixes after a reconnection.
—
Fixed in version 4.10.2 ().
-
WSA-2026-20: [Relay] Missing size limit of data queued for sending to clients.
—
Fixed in version 4.10.1 ().
-
WSA-2026-19: [Relay] Missing rejection of invalid websocket frames.
—
Fixed in version 4.10.1 ().
-
WSA-2026-18: [Relay] Missing size limit for the unterminated Relay text message received from a client.
—
Fixed in version 4.10.1 ().
-
WSA-2026-17: [Xfer] Bypass of user authorization for start of DCC file transfer.
—
Fixed in version 4.10.1 ().
-
WSA-2026-16: [Xfer] Missing size limit for the unterminated Xfer chat message.
—
Fixed in version 4.10.1 ().
-
WSA-2026-15: [Xfer] Write of DCC file received outside of configured download path.
—
Fixed in version 4.10.1 ().
-
WSA-2026-13: [IRC] Use-after-free in the irc plugin when a batched message disconnects the server.
—
Fixed in version 4.9.5 ().
-
WSA-2026-12: [IRC] Stack buffer overflow when building a JOIN command with channel keys.
—
Fixed in version 4.9.5 ().
-
WSA-2026-11: [Logger] Write of logger file outside of configured path.
—
Fixed in version 4.9.4 ().
-
WSA-2026-7: [Xfer] Buffer overflow when receiving a line in a Xfer chat (DCC chat) buffer.
—
Fixed in version 4.9.2 ().
-
WSA-2026-6: [Xfer] Write of DCC file received outside of configured download path.
—
Fixed in version 4.9.2 ().
-
WSA-2026-5: [IRC] Buffer overflow when receiving a DCC file.
—
Fixed in version 4.9.2 ().
-
WSA-2026-4: [Relay] Missing size limit for the received websocket frame, HTTP message and HTTP body.
—
Fixed in version 4.9.2 ().
-
WSA-2026-3: [IRC] Missing size limit for the unterminated IRC message or isupport value (message 005).
—
Fixed in version 4.9.2 ().
-
WSA-2026-2: [API, Relay] Non-constant time password/hash comparison.
—
Fixed in version 4.9.1 ().
-
WSA-2025-7: [Core] Buffer overflow in range of chars in evaluated expressions.
—
Fixed in version 4.6.3 ().
-
WSA-2025-6: [Core] Buffer overflow in base 32 encoding in evaluated expressions.
—
Fixed in version 4.6.3 ().
-
WSA-2025-5: [Core] Buffer overflow in syntax highlighting of evaluated expressions.
—
Fixed in version 4.6.3 ().
-
WSA-2025-4: [Core] Buffer overflow in parsing of date/time.
—
Fixed in version 4.6.3 ().
-
WSA-2025-3: [Core] Integer overflow in conversion of version to an integer number.
—
Fixed in version 4.6.3 ().
-
WSA-2025-2: [Core] Integer overflow in base32 decode/encode functions.
—
Fixed in version 4.6.3 ().
-
WSA-2025-1: [Core] Integer overflow with decimal numbers in calculation of expression.
—
Fixed in version 4.6.3 ().
-
WSA-2024-1: [Core, Plugins] Integer overflow in loops on lists.
—
Fixed in version 4.4.2 ().
Affected by 31 vulnerabilities:
-
WSA-2026-32: [Relay] Denial of service with many passwords in command init received from a relay client.
—
Fixed in version 4.10.4 ().
-
WSA-2026-31: [Relay] Bypass of TOTP and denial of service with invalid TOTP received from a relay client.
—
Fixed in version 4.10.4 ().
-
WSA-2026-30: [Xfer] Incoming files and chats auto-accepted from a nick on the wrong server.
—
Fixed in version 4.10.3 ().
-
WSA-2026-28: [Xfer] Missing checks of the resume position received in DCC RESUME and DCC ACCEPT.
—
Fixed in version 4.10.3 ().
-
WSA-2026-27: [Relay] Denial of service with huge IRC messages received from a relay client.
—
Fixed in version 4.10.3 ().
-
WSA-2026-26: [IRC] Missing checks in SASL authentication with SCRAM mechanisms.
—
Fixed in version 4.10.3 ().
-
WSA-2026-25: [IRC] Evaluation of untrusted strings received from the IRC server or an IRC URL.
—
Fixed in version 4.10.2 ().
-
WSA-2026-24: [Relay] Missing size limit for HTTP headers received from a client.
—
Fixed in version 4.10.2 ().
-
WSA-2026-23: [Core] Heap buffer overflow in charset conversion.
—
Fixed in version 4.10.2 ().
-
WSA-2026-22: [Relay] Heap buffer overflow in path of hdata sent to clients with "weechat" protocol.
—
Fixed in version 4.10.2 ().
-
WSA-2026-21: [IRC] Heap buffer overflow in nick prefixes after a reconnection.
—
Fixed in version 4.10.2 ().
-
WSA-2026-20: [Relay] Missing size limit of data queued for sending to clients.
—
Fixed in version 4.10.1 ().
-
WSA-2026-19: [Relay] Missing rejection of invalid websocket frames.
—
Fixed in version 4.10.1 ().
-
WSA-2026-18: [Relay] Missing size limit for the unterminated Relay text message received from a client.
—
Fixed in version 4.10.1 ().
-
WSA-2026-17: [Xfer] Bypass of user authorization for start of DCC file transfer.
—
Fixed in version 4.10.1 ().
-
WSA-2026-16: [Xfer] Missing size limit for the unterminated Xfer chat message.
—
Fixed in version 4.10.1 ().
-
WSA-2026-15: [Xfer] Write of DCC file received outside of configured download path.
—
Fixed in version 4.10.1 ().
-
WSA-2026-13: [IRC] Use-after-free in the irc plugin when a batched message disconnects the server.
—
Fixed in version 4.9.5 ().
-
WSA-2026-12: [IRC] Stack buffer overflow when building a JOIN command with channel keys.
—
Fixed in version 4.9.5 ().
-
WSA-2026-11: [Logger] Write of logger file outside of configured path.
—
Fixed in version 4.9.4 ().
-
WSA-2026-7: [Xfer] Buffer overflow when receiving a line in a Xfer chat (DCC chat) buffer.
—
Fixed in version 4.9.2 ().
-
WSA-2026-6: [Xfer] Write of DCC file received outside of configured download path.
—
Fixed in version 4.9.2 ().
-
WSA-2026-4: [Relay] Missing size limit for the received websocket frame, HTTP message and HTTP body.
—
Fixed in version 4.9.2 ().
-
WSA-2026-3: [IRC] Missing size limit for the unterminated IRC message or isupport value (message 005).
—
Fixed in version 4.9.2 ().
-
WSA-2026-2: [API, Relay] Non-constant time password/hash comparison.
—
Fixed in version 4.9.1 ().
-
WSA-2025-7: [Core] Buffer overflow in range of chars in evaluated expressions.
—
Fixed in version 4.6.3 ().
-
WSA-2025-6: [Core] Buffer overflow in base 32 encoding in evaluated expressions.
—
Fixed in version 4.6.3 ().
-
WSA-2025-3: [Core] Integer overflow in conversion of version to an integer number.
—
Fixed in version 4.6.3 ().
-
WSA-2025-2: [Core] Integer overflow in base32 decode/encode functions.
—
Fixed in version 4.6.3 ().
-
WSA-2025-1: [Core] Integer overflow with decimal numbers in calculation of expression.
—
Fixed in version 4.6.3 ().
-
WSA-2024-1: [Core, Plugins] Integer overflow in loops on lists.
—
Fixed in version 4.4.2 ().
Affected by 32 vulnerabilities:
-
WSA-2026-32: [Relay] Denial of service with many passwords in command init received from a relay client.
—
Fixed in version 4.10.4 ().
-
WSA-2026-31: [Relay] Bypass of TOTP and denial of service with invalid TOTP received from a relay client.
—
Fixed in version 4.10.4 ().
-
WSA-2026-30: [Xfer] Incoming files and chats auto-accepted from a nick on the wrong server.
—
Fixed in version 4.10.3 ().
-
WSA-2026-28: [Xfer] Missing checks of the resume position received in DCC RESUME and DCC ACCEPT.
—
Fixed in version 4.10.3 ().
-
WSA-2026-27: [Relay] Denial of service with huge IRC messages received from a relay client.
—
Fixed in version 4.10.3 ().
-
WSA-2026-26: [IRC] Missing checks in SASL authentication with SCRAM mechanisms.
—
Fixed in version 4.10.3 ().
-
WSA-2026-25: [IRC] Evaluation of untrusted strings received from the IRC server or an IRC URL.
—
Fixed in version 4.10.2 ().
-
WSA-2026-24: [Relay] Missing size limit for HTTP headers received from a client.
—
Fixed in version 4.10.2 ().
-
WSA-2026-23: [Core] Heap buffer overflow in charset conversion.
—
Fixed in version 4.10.2 ().
-
WSA-2026-22: [Relay] Heap buffer overflow in path of hdata sent to clients with "weechat" protocol.
—
Fixed in version 4.10.2 ().
-
WSA-2026-21: [IRC] Heap buffer overflow in nick prefixes after a reconnection.
—
Fixed in version 4.10.2 ().
-
WSA-2026-20: [Relay] Missing size limit of data queued for sending to clients.
—
Fixed in version 4.10.1 ().
-
WSA-2026-19: [Relay] Missing rejection of invalid websocket frames.
—
Fixed in version 4.10.1 ().
-
WSA-2026-18: [Relay] Missing size limit for the unterminated Relay text message received from a client.
—
Fixed in version 4.10.1 ().
-
WSA-2026-17: [Xfer] Bypass of user authorization for start of DCC file transfer.
—
Fixed in version 4.10.1 ().
-
WSA-2026-16: [Xfer] Missing size limit for the unterminated Xfer chat message.
—
Fixed in version 4.10.1 ().
-
WSA-2026-15: [Xfer] Write of DCC file received outside of configured download path.
—
Fixed in version 4.10.1 ().
-
WSA-2026-13: [IRC] Use-after-free in the irc plugin when a batched message disconnects the server.
—
Fixed in version 4.9.5 ().
-
WSA-2026-12: [IRC] Stack buffer overflow when building a JOIN command with channel keys.
—
Fixed in version 4.9.5 ().
-
WSA-2026-11: [Logger] Write of logger file outside of configured path.
—
Fixed in version 4.9.4 ().
-
WSA-2026-7: [Xfer] Buffer overflow when receiving a line in a Xfer chat (DCC chat) buffer.
—
Fixed in version 4.9.2 ().
-
WSA-2026-6: [Xfer] Write of DCC file received outside of configured download path.
—
Fixed in version 4.9.2 ().
-
WSA-2026-5: [IRC] Buffer overflow when receiving a DCC file.
—
Fixed in version 4.9.2 ().
-
WSA-2026-4: [Relay] Missing size limit for the received websocket frame, HTTP message and HTTP body.
—
Fixed in version 4.9.2 ().
-
WSA-2026-3: [IRC] Missing size limit for the unterminated IRC message or isupport value (message 005).
—
Fixed in version 4.9.2 ().
-
WSA-2026-2: [API, Relay] Non-constant time password/hash comparison.
—
Fixed in version 4.9.1 ().
-
WSA-2025-7: [Core] Buffer overflow in range of chars in evaluated expressions.
—
Fixed in version 4.6.3 ().
-
WSA-2025-6: [Core] Buffer overflow in base 32 encoding in evaluated expressions.
—
Fixed in version 4.6.3 ().
-
WSA-2025-3: [Core] Integer overflow in conversion of version to an integer number.
—
Fixed in version 4.6.3 ().
-
WSA-2025-2: [Core] Integer overflow in base32 decode/encode functions.
—
Fixed in version 4.6.3 ().
-
WSA-2025-1: [Core] Integer overflow with decimal numbers in calculation of expression.
—
Fixed in version 4.6.3 ().
-
WSA-2024-1: [Core, Plugins] Integer overflow in loops on lists.
—
Fixed in version 4.4.2 ().
Affected by 31 vulnerabilities:
-
WSA-2026-32: [Relay] Denial of service with many passwords in command init received from a relay client.
—
Fixed in version 4.10.4 ().
-
WSA-2026-31: [Relay] Bypass of TOTP and denial of service with invalid TOTP received from a relay client.
—
Fixed in version 4.10.4 ().
-
WSA-2026-30: [Xfer] Incoming files and chats auto-accepted from a nick on the wrong server.
—
Fixed in version 4.10.3 ().
-
WSA-2026-28: [Xfer] Missing checks of the resume position received in DCC RESUME and DCC ACCEPT.
—
Fixed in version 4.10.3 ().
-
WSA-2026-27: [Relay] Denial of service with huge IRC messages received from a relay client.
—
Fixed in version 4.10.3 ().
-
WSA-2026-26: [IRC] Missing checks in SASL authentication with SCRAM mechanisms.
—
Fixed in version 4.10.3 ().
-
WSA-2026-25: [IRC] Evaluation of untrusted strings received from the IRC server or an IRC URL.
—
Fixed in version 4.10.2 ().
-
WSA-2026-24: [Relay] Missing size limit for HTTP headers received from a client.
—
Fixed in version 4.10.2 ().
-
WSA-2026-23: [Core] Heap buffer overflow in charset conversion.
—
Fixed in version 4.10.2 ().
-
WSA-2026-22: [Relay] Heap buffer overflow in path of hdata sent to clients with "weechat" protocol.
—
Fixed in version 4.10.2 ().
-
WSA-2026-21: [IRC] Heap buffer overflow in nick prefixes after a reconnection.
—
Fixed in version 4.10.2 ().
-
WSA-2026-20: [Relay] Missing size limit of data queued for sending to clients.
—
Fixed in version 4.10.1 ().
-
WSA-2026-19: [Relay] Missing rejection of invalid websocket frames.
—
Fixed in version 4.10.1 ().
-
WSA-2026-18: [Relay] Missing size limit for the unterminated Relay text message received from a client.
—
Fixed in version 4.10.1 ().
-
WSA-2026-17: [Xfer] Bypass of user authorization for start of DCC file transfer.
—
Fixed in version 4.10.1 ().
-
WSA-2026-16: [Xfer] Missing size limit for the unterminated Xfer chat message.
—
Fixed in version 4.10.1 ().
-
WSA-2026-15: [Xfer] Write of DCC file received outside of configured download path.
—
Fixed in version 4.10.1 ().
-
WSA-2026-13: [IRC] Use-after-free in the irc plugin when a batched message disconnects the server.
—
Fixed in version 4.9.5 ().
-
WSA-2026-12: [IRC] Stack buffer overflow when building a JOIN command with channel keys.
—
Fixed in version 4.9.5 ().
-
WSA-2026-11: [Logger] Write of logger file outside of configured path.
—
Fixed in version 4.9.4 ().
-
WSA-2026-7: [Xfer] Buffer overflow when receiving a line in a Xfer chat (DCC chat) buffer.
—
Fixed in version 4.9.2 ().
-
WSA-2026-6: [Xfer] Write of DCC file received outside of configured download path.
—
Fixed in version 4.9.2 ().
-
WSA-2026-4: [Relay] Missing size limit for the received websocket frame, HTTP message and HTTP body.
—
Fixed in version 4.9.2 ().
-
WSA-2026-3: [IRC] Missing size limit for the unterminated IRC message or isupport value (message 005).
—
Fixed in version 4.9.2 ().
-
WSA-2026-2: [API, Relay] Non-constant time password/hash comparison.
—
Fixed in version 4.9.1 ().
-
WSA-2025-7: [Core] Buffer overflow in range of chars in evaluated expressions.
—
Fixed in version 4.6.3 ().
-
WSA-2025-6: [Core] Buffer overflow in base 32 encoding in evaluated expressions.
—
Fixed in version 4.6.3 ().
-
WSA-2025-3: [Core] Integer overflow in conversion of version to an integer number.
—
Fixed in version 4.6.3 ().
-
WSA-2025-2: [Core] Integer overflow in base32 decode/encode functions.
—
Fixed in version 4.6.3 ().
-
WSA-2025-1: [Core] Integer overflow with decimal numbers in calculation of expression.
—
Fixed in version 4.6.3 ().
-
WSA-2024-1: [Core, Plugins] Integer overflow in loops on lists.
—
Fixed in version 4.4.2 ().
Affected by 32 vulnerabilities:
-
WSA-2026-32: [Relay] Denial of service with many passwords in command init received from a relay client.
—
Fixed in version 4.10.4 ().
-
WSA-2026-31: [Relay] Bypass of TOTP and denial of service with invalid TOTP received from a relay client.
—
Fixed in version 4.10.4 ().
-
WSA-2026-30: [Xfer] Incoming files and chats auto-accepted from a nick on the wrong server.
—
Fixed in version 4.10.3 ().
-
WSA-2026-28: [Xfer] Missing checks of the resume position received in DCC RESUME and DCC ACCEPT.
—
Fixed in version 4.10.3 ().
-
WSA-2026-27: [Relay] Denial of service with huge IRC messages received from a relay client.
—
Fixed in version 4.10.3 ().
-
WSA-2026-26: [IRC] Missing checks in SASL authentication with SCRAM mechanisms.
—
Fixed in version 4.10.3 ().
-
WSA-2026-25: [IRC] Evaluation of untrusted strings received from the IRC server or an IRC URL.
—
Fixed in version 4.10.2 ().
-
WSA-2026-24: [Relay] Missing size limit for HTTP headers received from a client.
—
Fixed in version 4.10.2 ().
-
WSA-2026-23: [Core] Heap buffer overflow in charset conversion.
—
Fixed in version 4.10.2 ().
-
WSA-2026-22: [Relay] Heap buffer overflow in path of hdata sent to clients with "weechat" protocol.
—
Fixed in version 4.10.2 ().
-
WSA-2026-21: [IRC] Heap buffer overflow in nick prefixes after a reconnection.
—
Fixed in version 4.10.2 ().
-
WSA-2026-20: [Relay] Missing size limit of data queued for sending to clients.
—
Fixed in version 4.10.1 ().
-
WSA-2026-19: [Relay] Missing rejection of invalid websocket frames.
—
Fixed in version 4.10.1 ().
-
WSA-2026-18: [Relay] Missing size limit for the unterminated Relay text message received from a client.
—
Fixed in version 4.10.1 ().
-
WSA-2026-17: [Xfer] Bypass of user authorization for start of DCC file transfer.
—
Fixed in version 4.10.1 ().
-
WSA-2026-16: [Xfer] Missing size limit for the unterminated Xfer chat message.
—
Fixed in version 4.10.1 ().
-
WSA-2026-15: [Xfer] Write of DCC file received outside of configured download path.
—
Fixed in version 4.10.1 ().
-
WSA-2026-13: [IRC] Use-after-free in the irc plugin when a batched message disconnects the server.
—
Fixed in version 4.9.5 ().
-
WSA-2026-12: [IRC] Stack buffer overflow when building a JOIN command with channel keys.
—
Fixed in version 4.9.5 ().
-
WSA-2026-11: [Logger] Write of logger file outside of configured path.
—
Fixed in version 4.9.4 ().
-
WSA-2026-7: [Xfer] Buffer overflow when receiving a line in a Xfer chat (DCC chat) buffer.
—
Fixed in version 4.9.2 ().
-
WSA-2026-6: [Xfer] Write of DCC file received outside of configured download path.
—
Fixed in version 4.9.2 ().
-
WSA-2026-5: [IRC] Buffer overflow when receiving a DCC file.
—
Fixed in version 4.9.2 ().
-
WSA-2026-4: [Relay] Missing size limit for the received websocket frame, HTTP message and HTTP body.
—
Fixed in version 4.9.2 ().
-
WSA-2026-3: [IRC] Missing size limit for the unterminated IRC message or isupport value (message 005).
—
Fixed in version 4.9.2 ().
-
WSA-2026-2: [API, Relay] Non-constant time password/hash comparison.
—
Fixed in version 4.9.1 ().
-
WSA-2025-7: [Core] Buffer overflow in range of chars in evaluated expressions.
—
Fixed in version 4.6.3 ().
-
WSA-2025-6: [Core] Buffer overflow in base 32 encoding in evaluated expressions.
—
Fixed in version 4.6.3 ().
-
WSA-2025-3: [Core] Integer overflow in conversion of version to an integer number.
—
Fixed in version 4.6.3 ().
-
WSA-2025-2: [Core] Integer overflow in base32 decode/encode functions.
—
Fixed in version 4.6.3 ().
-
WSA-2025-1: [Core] Integer overflow with decimal numbers in calculation of expression.
—
Fixed in version 4.6.3 ().
-
WSA-2024-1: [Core, Plugins] Integer overflow in loops on lists.
—
Fixed in version 4.4.2 ().
Affected by 32 vulnerabilities:
-
WSA-2026-32: [Relay] Denial of service with many passwords in command init received from a relay client.
—
Fixed in version 4.10.4 ().
-
WSA-2026-31: [Relay] Bypass of TOTP and denial of service with invalid TOTP received from a relay client.
—
Fixed in version 4.10.4 ().
-
WSA-2026-30: [Xfer] Incoming files and chats auto-accepted from a nick on the wrong server.
—
Fixed in version 4.10.3 ().
-
WSA-2026-28: [Xfer] Missing checks of the resume position received in DCC RESUME and DCC ACCEPT.
—
Fixed in version 4.10.3 ().
-
WSA-2026-27: [Relay] Denial of service with huge IRC messages received from a relay client.
—
Fixed in version 4.10.3 ().
-
WSA-2026-26: [IRC] Missing checks in SASL authentication with SCRAM mechanisms.
—
Fixed in version 4.10.3 ().
-
WSA-2026-25: [IRC] Evaluation of untrusted strings received from the IRC server or an IRC URL.
—
Fixed in version 4.10.2 ().
-
WSA-2026-24: [Relay] Missing size limit for HTTP headers received from a client.
—
Fixed in version 4.10.2 ().
-
WSA-2026-23: [Core] Heap buffer overflow in charset conversion.
—
Fixed in version 4.10.2 ().
-
WSA-2026-22: [Relay] Heap buffer overflow in path of hdata sent to clients with "weechat" protocol.
—
Fixed in version 4.10.2 ().
-
WSA-2026-21: [IRC] Heap buffer overflow in nick prefixes after a reconnection.
—
Fixed in version 4.10.2 ().
-
WSA-2026-20: [Relay] Missing size limit of data queued for sending to clients.
—
Fixed in version 4.10.1 ().
-
WSA-2026-19: [Relay] Missing rejection of invalid websocket frames.
—
Fixed in version 4.10.1 ().
-
WSA-2026-18: [Relay] Missing size limit for the unterminated Relay text message received from a client.
—
Fixed in version 4.10.1 ().
-
WSA-2026-17: [Xfer] Bypass of user authorization for start of DCC file transfer.
—
Fixed in version 4.10.1 ().
-
WSA-2026-16: [Xfer] Missing size limit for the unterminated Xfer chat message.
—
Fixed in version 4.10.1 ().
-
WSA-2026-15: [Xfer] Write of DCC file received outside of configured download path.
—
Fixed in version 4.10.1 ().
-
WSA-2026-13: [IRC] Use-after-free in the irc plugin when a batched message disconnects the server.
—
Fixed in version 4.9.5 ().
-
WSA-2026-12: [IRC] Stack buffer overflow when building a JOIN command with channel keys.
—
Fixed in version 4.9.5 ().
-
WSA-2026-11: [Logger] Write of logger file outside of configured path.
—
Fixed in version 4.9.4 ().
-
WSA-2026-7: [Xfer] Buffer overflow when receiving a line in a Xfer chat (DCC chat) buffer.
—
Fixed in version 4.9.2 ().
-
WSA-2026-6: [Xfer] Write of DCC file received outside of configured download path.
—
Fixed in version 4.9.2 ().
-
WSA-2026-5: [IRC] Buffer overflow when receiving a DCC file.
—
Fixed in version 4.9.2 ().
-
WSA-2026-4: [Relay] Missing size limit for the received websocket frame, HTTP message and HTTP body.
—
Fixed in version 4.9.2 ().
-
WSA-2026-3: [IRC] Missing size limit for the unterminated IRC message or isupport value (message 005).
—
Fixed in version 4.9.2 ().
-
WSA-2026-2: [API, Relay] Non-constant time password/hash comparison.
—
Fixed in version 4.9.1 ().
-
WSA-2025-7: [Core] Buffer overflow in range of chars in evaluated expressions.
—
Fixed in version 4.6.3 ().
-
WSA-2025-6: [Core] Buffer overflow in base 32 encoding in evaluated expressions.
—
Fixed in version 4.6.3 ().
-
WSA-2025-3: [Core] Integer overflow in conversion of version to an integer number.
—
Fixed in version 4.6.3 ().
-
WSA-2025-2: [Core] Integer overflow in base32 decode/encode functions.
—
Fixed in version 4.6.3 ().
-
WSA-2025-1: [Core] Integer overflow with decimal numbers in calculation of expression.
—
Fixed in version 4.6.3 ().
-
WSA-2024-1: [Core, Plugins] Integer overflow in loops on lists.
—
Fixed in version 4.4.2 ().
Affected by 31 vulnerabilities:
-
WSA-2026-32: [Relay] Denial of service with many passwords in command init received from a relay client.
—
Fixed in version 4.10.4 ().
-
WSA-2026-31: [Relay] Bypass of TOTP and denial of service with invalid TOTP received from a relay client.
—
Fixed in version 4.10.4 ().
-
WSA-2026-30: [Xfer] Incoming files and chats auto-accepted from a nick on the wrong server.
—
Fixed in version 4.10.3 ().
-
WSA-2026-28: [Xfer] Missing checks of the resume position received in DCC RESUME and DCC ACCEPT.
—
Fixed in version 4.10.3 ().
-
WSA-2026-27: [Relay] Denial of service with huge IRC messages received from a relay client.
—
Fixed in version 4.10.3 ().
-
WSA-2026-26: [IRC] Missing checks in SASL authentication with SCRAM mechanisms.
—
Fixed in version 4.10.3 ().
-
WSA-2026-25: [IRC] Evaluation of untrusted strings received from the IRC server or an IRC URL.
—
Fixed in version 4.10.2 ().
-
WSA-2026-24: [Relay] Missing size limit for HTTP headers received from a client.
—
Fixed in version 4.10.2 ().
-
WSA-2026-23: [Core] Heap buffer overflow in charset conversion.
—
Fixed in version 4.10.2 ().
-
WSA-2026-22: [Relay] Heap buffer overflow in path of hdata sent to clients with "weechat" protocol.
—
Fixed in version 4.10.2 ().
-
WSA-2026-21: [IRC] Heap buffer overflow in nick prefixes after a reconnection.
—
Fixed in version 4.10.2 ().
-
WSA-2026-20: [Relay] Missing size limit of data queued for sending to clients.
—
Fixed in version 4.10.1 ().
-
WSA-2026-19: [Relay] Missing rejection of invalid websocket frames.
—
Fixed in version 4.10.1 ().
-
WSA-2026-18: [Relay] Missing size limit for the unterminated Relay text message received from a client.
—
Fixed in version 4.10.1 ().
-
WSA-2026-17: [Xfer] Bypass of user authorization for start of DCC file transfer.
—
Fixed in version 4.10.1 ().
-
WSA-2026-16: [Xfer] Missing size limit for the unterminated Xfer chat message.
—
Fixed in version 4.10.1 ().
-
WSA-2026-15: [Xfer] Write of DCC file received outside of configured download path.
—
Fixed in version 4.10.1 ().
-
WSA-2026-13: [IRC] Use-after-free in the irc plugin when a batched message disconnects the server.
—
Fixed in version 4.9.5 ().
-
WSA-2026-12: [IRC] Stack buffer overflow when building a JOIN command with channel keys.
—
Fixed in version 4.9.5 ().
-
WSA-2026-11: [Logger] Write of logger file outside of configured path.
—
Fixed in version 4.9.4 ().
-
WSA-2026-7: [Xfer] Buffer overflow when receiving a line in a Xfer chat (DCC chat) buffer.
—
Fixed in version 4.9.2 ().
-
WSA-2026-6: [Xfer] Write of DCC file received outside of configured download path.
—
Fixed in version 4.9.2 ().
-
WSA-2026-4: [Relay] Missing size limit for the received websocket frame, HTTP message and HTTP body.
—
Fixed in version 4.9.2 ().
-
WSA-2026-3: [IRC] Missing size limit for the unterminated IRC message or isupport value (message 005).
—
Fixed in version 4.9.2 ().
-
WSA-2026-2: [API, Relay] Non-constant time password/hash comparison.
—
Fixed in version 4.9.1 ().
-
WSA-2025-7: [Core] Buffer overflow in range of chars in evaluated expressions.
—
Fixed in version 4.6.3 ().
-
WSA-2025-6: [Core] Buffer overflow in base 32 encoding in evaluated expressions.
—
Fixed in version 4.6.3 ().
-
WSA-2025-3: [Core] Integer overflow in conversion of version to an integer number.
—
Fixed in version 4.6.3 ().
-
WSA-2025-2: [Core] Integer overflow in base32 decode/encode functions.
—
Fixed in version 4.6.3 ().
-
WSA-2025-1: [Core] Integer overflow with decimal numbers in calculation of expression.
—
Fixed in version 4.6.3 ().
-
WSA-2024-1: [Core, Plugins] Integer overflow in loops on lists.
—
Fixed in version 4.4.2 ().
Affected by 32 vulnerabilities:
-
WSA-2026-32: [Relay] Denial of service with many passwords in command init received from a relay client.
—
Fixed in version 4.10.4 ().
-
WSA-2026-31: [Relay] Bypass of TOTP and denial of service with invalid TOTP received from a relay client.
—
Fixed in version 4.10.4 ().
-
WSA-2026-30: [Xfer] Incoming files and chats auto-accepted from a nick on the wrong server.
—
Fixed in version 4.10.3 ().
-
WSA-2026-28: [Xfer] Missing checks of the resume position received in DCC RESUME and DCC ACCEPT.
—
Fixed in version 4.10.3 ().
-
WSA-2026-27: [Relay] Denial of service with huge IRC messages received from a relay client.
—
Fixed in version 4.10.3 ().
-
WSA-2026-26: [IRC] Missing checks in SASL authentication with SCRAM mechanisms.
—
Fixed in version 4.10.3 ().
-
WSA-2026-25: [IRC] Evaluation of untrusted strings received from the IRC server or an IRC URL.
—
Fixed in version 4.10.2 ().
-
WSA-2026-24: [Relay] Missing size limit for HTTP headers received from a client.
—
Fixed in version 4.10.2 ().
-
WSA-2026-23: [Core] Heap buffer overflow in charset conversion.
—
Fixed in version 4.10.2 ().
-
WSA-2026-22: [Relay] Heap buffer overflow in path of hdata sent to clients with "weechat" protocol.
—
Fixed in version 4.10.2 ().
-
WSA-2026-21: [IRC] Heap buffer overflow in nick prefixes after a reconnection.
—
Fixed in version 4.10.2 ().
-
WSA-2026-20: [Relay] Missing size limit of data queued for sending to clients.
—
Fixed in version 4.10.1 ().
-
WSA-2026-19: [Relay] Missing rejection of invalid websocket frames.
—
Fixed in version 4.10.1 ().
-
WSA-2026-18: [Relay] Missing size limit for the unterminated Relay text message received from a client.
—
Fixed in version 4.10.1 ().
-
WSA-2026-17: [Xfer] Bypass of user authorization for start of DCC file transfer.
—
Fixed in version 4.10.1 ().
-
WSA-2026-16: [Xfer] Missing size limit for the unterminated Xfer chat message.
—
Fixed in version 4.10.1 ().
-
WSA-2026-15: [Xfer] Write of DCC file received outside of configured download path.
—
Fixed in version 4.10.1 ().
-
WSA-2026-13: [IRC] Use-after-free in the irc plugin when a batched message disconnects the server.
—
Fixed in version 4.9.5 ().
-
WSA-2026-12: [IRC] Stack buffer overflow when building a JOIN command with channel keys.
—
Fixed in version 4.9.5 ().
-
WSA-2026-11: [Logger] Write of logger file outside of configured path.
—
Fixed in version 4.9.4 ().
-
WSA-2026-7: [Xfer] Buffer overflow when receiving a line in a Xfer chat (DCC chat) buffer.
—
Fixed in version 4.9.2 ().
-
WSA-2026-6: [Xfer] Write of DCC file received outside of configured download path.
—
Fixed in version 4.9.2 ().
-
WSA-2026-5: [IRC] Buffer overflow when receiving a DCC file.
—
Fixed in version 4.9.2 ().
-
WSA-2026-4: [Relay] Missing size limit for the received websocket frame, HTTP message and HTTP body.
—
Fixed in version 4.9.2 ().
-
WSA-2026-3: [IRC] Missing size limit for the unterminated IRC message or isupport value (message 005).
—
Fixed in version 4.9.2 ().
-
WSA-2026-2: [API, Relay] Non-constant time password/hash comparison.
—
Fixed in version 4.9.1 ().
-
WSA-2025-7: [Core] Buffer overflow in range of chars in evaluated expressions.
—
Fixed in version 4.6.3 ().
-
WSA-2025-6: [Core] Buffer overflow in base 32 encoding in evaluated expressions.
—
Fixed in version 4.6.3 ().
-
WSA-2025-3: [Core] Integer overflow in conversion of version to an integer number.
—
Fixed in version 4.6.3 ().
-
WSA-2025-2: [Core] Integer overflow in base32 decode/encode functions.
—
Fixed in version 4.6.3 ().
-
WSA-2025-1: [Core] Integer overflow with decimal numbers in calculation of expression.
—
Fixed in version 4.6.3 ().
-
WSA-2024-1: [Core, Plugins] Integer overflow in loops on lists.
—
Fixed in version 4.4.2 ().
Affected by 31 vulnerabilities:
-
WSA-2026-32: [Relay] Denial of service with many passwords in command init received from a relay client.
—
Fixed in version 4.10.4 ().
-
WSA-2026-31: [Relay] Bypass of TOTP and denial of service with invalid TOTP received from a relay client.
—
Fixed in version 4.10.4 ().
-
WSA-2026-30: [Xfer] Incoming files and chats auto-accepted from a nick on the wrong server.
—
Fixed in version 4.10.3 ().
-
WSA-2026-28: [Xfer] Missing checks of the resume position received in DCC RESUME and DCC ACCEPT.
—
Fixed in version 4.10.3 ().
-
WSA-2026-27: [Relay] Denial of service with huge IRC messages received from a relay client.
—
Fixed in version 4.10.3 ().
-
WSA-2026-26: [IRC] Missing checks in SASL authentication with SCRAM mechanisms.
—
Fixed in version 4.10.3 ().
-
WSA-2026-25: [IRC] Evaluation of untrusted strings received from the IRC server or an IRC URL.
—
Fixed in version 4.10.2 ().
-
WSA-2026-24: [Relay] Missing size limit for HTTP headers received from a client.
—
Fixed in version 4.10.2 ().
-
WSA-2026-23: [Core] Heap buffer overflow in charset conversion.
—
Fixed in version 4.10.2 ().
-
WSA-2026-22: [Relay] Heap buffer overflow in path of hdata sent to clients with "weechat" protocol.
—
Fixed in version 4.10.2 ().
-
WSA-2026-21: [IRC] Heap buffer overflow in nick prefixes after a reconnection.
—
Fixed in version 4.10.2 ().
-
WSA-2026-20: [Relay] Missing size limit of data queued for sending to clients.
—
Fixed in version 4.10.1 ().
-
WSA-2026-19: [Relay] Missing rejection of invalid websocket frames.
—
Fixed in version 4.10.1 ().
-
WSA-2026-18: [Relay] Missing size limit for the unterminated Relay text message received from a client.
—
Fixed in version 4.10.1 ().
-
WSA-2026-17: [Xfer] Bypass of user authorization for start of DCC file transfer.
—
Fixed in version 4.10.1 ().
-
WSA-2026-16: [Xfer] Missing size limit for the unterminated Xfer chat message.
—
Fixed in version 4.10.1 ().
-
WSA-2026-15: [Xfer] Write of DCC file received outside of configured download path.
—
Fixed in version 4.10.1 ().
-
WSA-2026-13: [IRC] Use-after-free in the irc plugin when a batched message disconnects the server.
—
Fixed in version 4.9.5 ().
-
WSA-2026-12: [IRC] Stack buffer overflow when building a JOIN command with channel keys.
—
Fixed in version 4.9.5 ().
-
WSA-2026-11: [Logger] Write of logger file outside of configured path.
—
Fixed in version 4.9.4 ().
-
WSA-2026-7: [Xfer] Buffer overflow when receiving a line in a Xfer chat (DCC chat) buffer.
—
Fixed in version 4.9.2 ().
-
WSA-2026-6: [Xfer] Write of DCC file received outside of configured download path.
—
Fixed in version 4.9.2 ().
-
WSA-2026-4: [Relay] Missing size limit for the received websocket frame, HTTP message and HTTP body.
—
Fixed in version 4.9.2 ().
-
WSA-2026-3: [IRC] Missing size limit for the unterminated IRC message or isupport value (message 005).
—
Fixed in version 4.9.2 ().
-
WSA-2026-2: [API, Relay] Non-constant time password/hash comparison.
—
Fixed in version 4.9.1 ().
-
WSA-2025-7: [Core] Buffer overflow in range of chars in evaluated expressions.
—
Fixed in version 4.6.3 ().
-
WSA-2025-6: [Core] Buffer overflow in base 32 encoding in evaluated expressions.
—
Fixed in version 4.6.3 ().
-
WSA-2025-3: [Core] Integer overflow in conversion of version to an integer number.
—
Fixed in version 4.6.3 ().
-
WSA-2025-2: [Core] Integer overflow in base32 decode/encode functions.
—
Fixed in version 4.6.3 ().
-
WSA-2025-1: [Core] Integer overflow with decimal numbers in calculation of expression.
—
Fixed in version 4.6.3 ().
-
WSA-2024-1: [Core, Plugins] Integer overflow in loops on lists.
—
Fixed in version 4.4.2 ().
Affected by 31 vulnerabilities:
-
WSA-2026-32: [Relay] Denial of service with many passwords in command init received from a relay client.
—
Fixed in version 4.10.4 ().
-
WSA-2026-31: [Relay] Bypass of TOTP and denial of service with invalid TOTP received from a relay client.
—
Fixed in version 4.10.4 ().
-
WSA-2026-30: [Xfer] Incoming files and chats auto-accepted from a nick on the wrong server.
—
Fixed in version 4.10.3 ().
-
WSA-2026-28: [Xfer] Missing checks of the resume position received in DCC RESUME and DCC ACCEPT.
—
Fixed in version 4.10.3 ().
-
WSA-2026-27: [Relay] Denial of service with huge IRC messages received from a relay client.
—
Fixed in version 4.10.3 ().
-
WSA-2026-26: [IRC] Missing checks in SASL authentication with SCRAM mechanisms.
—
Fixed in version 4.10.3 ().
-
WSA-2026-25: [IRC] Evaluation of untrusted strings received from the IRC server or an IRC URL.
—
Fixed in version 4.10.2 ().
-
WSA-2026-24: [Relay] Missing size limit for HTTP headers received from a client.
—
Fixed in version 4.10.2 ().
-
WSA-2026-23: [Core] Heap buffer overflow in charset conversion.
—
Fixed in version 4.10.2 ().
-
WSA-2026-22: [Relay] Heap buffer overflow in path of hdata sent to clients with "weechat" protocol.
—
Fixed in version 4.10.2 ().
-
WSA-2026-21: [IRC] Heap buffer overflow in nick prefixes after a reconnection.
—
Fixed in version 4.10.2 ().
-
WSA-2026-20: [Relay] Missing size limit of data queued for sending to clients.
—
Fixed in version 4.10.1 ().
-
WSA-2026-19: [Relay] Missing rejection of invalid websocket frames.
—
Fixed in version 4.10.1 ().
-
WSA-2026-18: [Relay] Missing size limit for the unterminated Relay text message received from a client.
—
Fixed in version 4.10.1 ().
-
WSA-2026-17: [Xfer] Bypass of user authorization for start of DCC file transfer.
—
Fixed in version 4.10.1 ().
-
WSA-2026-16: [Xfer] Missing size limit for the unterminated Xfer chat message.
—
Fixed in version 4.10.1 ().
-
WSA-2026-15: [Xfer] Write of DCC file received outside of configured download path.
—
Fixed in version 4.10.1 ().
-
WSA-2026-13: [IRC] Use-after-free in the irc plugin when a batched message disconnects the server.
—
Fixed in version 4.9.5 ().
-
WSA-2026-12: [IRC] Stack buffer overflow when building a JOIN command with channel keys.
—
Fixed in version 4.9.5 ().
-
WSA-2026-11: [Logger] Write of logger file outside of configured path.
—
Fixed in version 4.9.4 ().
-
WSA-2026-7: [Xfer] Buffer overflow when receiving a line in a Xfer chat (DCC chat) buffer.
—
Fixed in version 4.9.2 ().
-
WSA-2026-6: [Xfer] Write of DCC file received outside of configured download path.
—
Fixed in version 4.9.2 ().
-
WSA-2026-4: [Relay] Missing size limit for the received websocket frame, HTTP message and HTTP body.
—
Fixed in version 4.9.2 ().
-
WSA-2026-3: [IRC] Missing size limit for the unterminated IRC message or isupport value (message 005).
—
Fixed in version 4.9.2 ().
-
WSA-2026-2: [API, Relay] Non-constant time password/hash comparison.
—
Fixed in version 4.9.1 ().
-
WSA-2025-7: [Core] Buffer overflow in range of chars in evaluated expressions.
—
Fixed in version 4.6.3 ().
-
WSA-2025-6: [Core] Buffer overflow in base 32 encoding in evaluated expressions.
—
Fixed in version 4.6.3 ().
-
WSA-2025-3: [Core] Integer overflow in conversion of version to an integer number.
—
Fixed in version 4.6.3 ().
-
WSA-2025-2: [Core] Integer overflow in base32 decode/encode functions.
—
Fixed in version 4.6.3 ().
-
WSA-2025-1: [Core] Integer overflow with decimal numbers in calculation of expression.
—
Fixed in version 4.6.3 ().
-
WSA-2024-1: [Core, Plugins] Integer overflow in loops on lists.
—
Fixed in version 4.4.2 ().
Affected by 31 vulnerabilities:
-
WSA-2026-32: [Relay] Denial of service with many passwords in command init received from a relay client.
—
Fixed in version 4.10.4 ().
-
WSA-2026-31: [Relay] Bypass of TOTP and denial of service with invalid TOTP received from a relay client.
—
Fixed in version 4.10.4 ().
-
WSA-2026-30: [Xfer] Incoming files and chats auto-accepted from a nick on the wrong server.
—
Fixed in version 4.10.3 ().
-
WSA-2026-28: [Xfer] Missing checks of the resume position received in DCC RESUME and DCC ACCEPT.
—
Fixed in version 4.10.3 ().
-
WSA-2026-27: [Relay] Denial of service with huge IRC messages received from a relay client.
—
Fixed in version 4.10.3 ().
-
WSA-2026-26: [IRC] Missing checks in SASL authentication with SCRAM mechanisms.
—
Fixed in version 4.10.3 ().
-
WSA-2026-25: [IRC] Evaluation of untrusted strings received from the IRC server or an IRC URL.
—
Fixed in version 4.10.2 ().
-
WSA-2026-24: [Relay] Missing size limit for HTTP headers received from a client.
—
Fixed in version 4.10.2 ().
-
WSA-2026-23: [Core] Heap buffer overflow in charset conversion.
—
Fixed in version 4.10.2 ().
-
WSA-2026-22: [Relay] Heap buffer overflow in path of hdata sent to clients with "weechat" protocol.
—
Fixed in version 4.10.2 ().
-
WSA-2026-21: [IRC] Heap buffer overflow in nick prefixes after a reconnection.
—
Fixed in version 4.10.2 ().
-
WSA-2026-20: [Relay] Missing size limit of data queued for sending to clients.
—
Fixed in version 4.10.1 ().
-
WSA-2026-19: [Relay] Missing rejection of invalid websocket frames.
—
Fixed in version 4.10.1 ().
-
WSA-2026-18: [Relay] Missing size limit for the unterminated Relay text message received from a client.
—
Fixed in version 4.10.1 ().
-
WSA-2026-17: [Xfer] Bypass of user authorization for start of DCC file transfer.
—
Fixed in version 4.10.1 ().
-
WSA-2026-16: [Xfer] Missing size limit for the unterminated Xfer chat message.
—
Fixed in version 4.10.1 ().
-
WSA-2026-15: [Xfer] Write of DCC file received outside of configured download path.
—
Fixed in version 4.10.1 ().
-
WSA-2026-13: [IRC] Use-after-free in the irc plugin when a batched message disconnects the server.
—
Fixed in version 4.9.5 ().
-
WSA-2026-12: [IRC] Stack buffer overflow when building a JOIN command with channel keys.
—
Fixed in version 4.9.5 ().
-
WSA-2026-11: [Logger] Write of logger file outside of configured path.
—
Fixed in version 4.9.4 ().
-
WSA-2026-7: [Xfer] Buffer overflow when receiving a line in a Xfer chat (DCC chat) buffer.
—
Fixed in version 4.9.2 ().
-
WSA-2026-6: [Xfer] Write of DCC file received outside of configured download path.
—
Fixed in version 4.9.2 ().
-
WSA-2026-4: [Relay] Missing size limit for the received websocket frame, HTTP message and HTTP body.
—
Fixed in version 4.9.2 ().
-
WSA-2026-3: [IRC] Missing size limit for the unterminated IRC message or isupport value (message 005).
—
Fixed in version 4.9.2 ().
-
WSA-2026-2: [API, Relay] Non-constant time password/hash comparison.
—
Fixed in version 4.9.1 ().
-
WSA-2025-7: [Core] Buffer overflow in range of chars in evaluated expressions.
—
Fixed in version 4.6.3 ().
-
WSA-2025-6: [Core] Buffer overflow in base 32 encoding in evaluated expressions.
—
Fixed in version 4.6.3 ().
-
WSA-2025-3: [Core] Integer overflow in conversion of version to an integer number.
—
Fixed in version 4.6.3 ().
-
WSA-2025-2: [Core] Integer overflow in base32 decode/encode functions.
—
Fixed in version 4.6.3 ().
-
WSA-2025-1: [Core] Integer overflow with decimal numbers in calculation of expression.
—
Fixed in version 4.6.3 ().
-
WSA-2024-1: [Core, Plugins] Integer overflow in loops on lists.
—
Fixed in version 4.4.2 ().
Affected by 31 vulnerabilities:
-
WSA-2026-32: [Relay] Denial of service with many passwords in command init received from a relay client.
—
Fixed in version 4.10.4 ().
-
WSA-2026-31: [Relay] Bypass of TOTP and denial of service with invalid TOTP received from a relay client.
—
Fixed in version 4.10.4 ().
-
WSA-2026-30: [Xfer] Incoming files and chats auto-accepted from a nick on the wrong server.
—
Fixed in version 4.10.3 ().
-
WSA-2026-28: [Xfer] Missing checks of the resume position received in DCC RESUME and DCC ACCEPT.
—
Fixed in version 4.10.3 ().
-
WSA-2026-27: [Relay] Denial of service with huge IRC messages received from a relay client.
—
Fixed in version 4.10.3 ().
-
WSA-2026-26: [IRC] Missing checks in SASL authentication with SCRAM mechanisms.
—
Fixed in version 4.10.3 ().
-
WSA-2026-25: [IRC] Evaluation of untrusted strings received from the IRC server or an IRC URL.
—
Fixed in version 4.10.2 ().
-
WSA-2026-24: [Relay] Missing size limit for HTTP headers received from a client.
—
Fixed in version 4.10.2 ().
-
WSA-2026-23: [Core] Heap buffer overflow in charset conversion.
—
Fixed in version 4.10.2 ().
-
WSA-2026-22: [Relay] Heap buffer overflow in path of hdata sent to clients with "weechat" protocol.
—
Fixed in version 4.10.2 ().
-
WSA-2026-21: [IRC] Heap buffer overflow in nick prefixes after a reconnection.
—
Fixed in version 4.10.2 ().
-
WSA-2026-20: [Relay] Missing size limit of data queued for sending to clients.
—
Fixed in version 4.10.1 ().
-
WSA-2026-19: [Relay] Missing rejection of invalid websocket frames.
—
Fixed in version 4.10.1 ().
-
WSA-2026-18: [Relay] Missing size limit for the unterminated Relay text message received from a client.
—
Fixed in version 4.10.1 ().
-
WSA-2026-17: [Xfer] Bypass of user authorization for start of DCC file transfer.
—
Fixed in version 4.10.1 ().
-
WSA-2026-16: [Xfer] Missing size limit for the unterminated Xfer chat message.
—
Fixed in version 4.10.1 ().
-
WSA-2026-15: [Xfer] Write of DCC file received outside of configured download path.
—
Fixed in version 4.10.1 ().
-
WSA-2026-13: [IRC] Use-after-free in the irc plugin when a batched message disconnects the server.
—
Fixed in version 4.9.5 ().
-
WSA-2026-12: [IRC] Stack buffer overflow when building a JOIN command with channel keys.
—
Fixed in version 4.9.5 ().
-
WSA-2026-11: [Logger] Write of logger file outside of configured path.
—
Fixed in version 4.9.4 ().
-
WSA-2026-7: [Xfer] Buffer overflow when receiving a line in a Xfer chat (DCC chat) buffer.
—
Fixed in version 4.9.2 ().
-
WSA-2026-6: [Xfer] Write of DCC file received outside of configured download path.
—
Fixed in version 4.9.2 ().
-
WSA-2026-4: [Relay] Missing size limit for the received websocket frame, HTTP message and HTTP body.
—
Fixed in version 4.9.2 ().
-
WSA-2026-3: [IRC] Missing size limit for the unterminated IRC message or isupport value (message 005).
—
Fixed in version 4.9.2 ().
-
WSA-2026-2: [API, Relay] Non-constant time password/hash comparison.
—
Fixed in version 4.9.1 ().
-
WSA-2025-7: [Core] Buffer overflow in range of chars in evaluated expressions.
—
Fixed in version 4.6.3 ().
-
WSA-2025-6: [Core] Buffer overflow in base 32 encoding in evaluated expressions.
—
Fixed in version 4.6.3 ().
-
WSA-2025-3: [Core] Integer overflow in conversion of version to an integer number.
—
Fixed in version 4.6.3 ().
-
WSA-2025-2: [Core] Integer overflow in base32 decode/encode functions.
—
Fixed in version 4.6.3 ().
-
WSA-2025-1: [Core] Integer overflow with decimal numbers in calculation of expression.
—
Fixed in version 4.6.3 ().
-
WSA-2024-1: [Core, Plugins] Integer overflow in loops on lists.
—
Fixed in version 4.4.2 ().
Affected by 31 vulnerabilities:
-
WSA-2026-32: [Relay] Denial of service with many passwords in command init received from a relay client.
—
Fixed in version 4.10.4 ().
-
WSA-2026-31: [Relay] Bypass of TOTP and denial of service with invalid TOTP received from a relay client.
—
Fixed in version 4.10.4 ().
-
WSA-2026-30: [Xfer] Incoming files and chats auto-accepted from a nick on the wrong server.
—
Fixed in version 4.10.3 ().
-
WSA-2026-28: [Xfer] Missing checks of the resume position received in DCC RESUME and DCC ACCEPT.
—
Fixed in version 4.10.3 ().
-
WSA-2026-27: [Relay] Denial of service with huge IRC messages received from a relay client.
—
Fixed in version 4.10.3 ().
-
WSA-2026-26: [IRC] Missing checks in SASL authentication with SCRAM mechanisms.
—
Fixed in version 4.10.3 ().
-
WSA-2026-25: [IRC] Evaluation of untrusted strings received from the IRC server or an IRC URL.
—
Fixed in version 4.10.2 ().
-
WSA-2026-24: [Relay] Missing size limit for HTTP headers received from a client.
—
Fixed in version 4.10.2 ().
-
WSA-2026-23: [Core] Heap buffer overflow in charset conversion.
—
Fixed in version 4.10.2 ().
-
WSA-2026-22: [Relay] Heap buffer overflow in path of hdata sent to clients with "weechat" protocol.
—
Fixed in version 4.10.2 ().
-
WSA-2026-21: [IRC] Heap buffer overflow in nick prefixes after a reconnection.
—
Fixed in version 4.10.2 ().
-
WSA-2026-20: [Relay] Missing size limit of data queued for sending to clients.
—
Fixed in version 4.10.1 ().
-
WSA-2026-19: [Relay] Missing rejection of invalid websocket frames.
—
Fixed in version 4.10.1 ().
-
WSA-2026-18: [Relay] Missing size limit for the unterminated Relay text message received from a client.
—
Fixed in version 4.10.1 ().
-
WSA-2026-17: [Xfer] Bypass of user authorization for start of DCC file transfer.
—
Fixed in version 4.10.1 ().
-
WSA-2026-16: [Xfer] Missing size limit for the unterminated Xfer chat message.
—
Fixed in version 4.10.1 ().
-
WSA-2026-15: [Xfer] Write of DCC file received outside of configured download path.
—
Fixed in version 4.10.1 ().
-
WSA-2026-13: [IRC] Use-after-free in the irc plugin when a batched message disconnects the server.
—
Fixed in version 4.9.5 ().
-
WSA-2026-12: [IRC] Stack buffer overflow when building a JOIN command with channel keys.
—
Fixed in version 4.9.5 ().
-
WSA-2026-11: [Logger] Write of logger file outside of configured path.
—
Fixed in version 4.9.4 ().
-
WSA-2026-7: [Xfer] Buffer overflow when receiving a line in a Xfer chat (DCC chat) buffer.
—
Fixed in version 4.9.2 ().
-
WSA-2026-6: [Xfer] Write of DCC file received outside of configured download path.
—
Fixed in version 4.9.2 ().
-
WSA-2026-4: [Relay] Missing size limit for the received websocket frame, HTTP message and HTTP body.
—
Fixed in version 4.9.2 ().
-
WSA-2026-3: [IRC] Missing size limit for the unterminated IRC message or isupport value (message 005).
—
Fixed in version 4.9.2 ().
-
WSA-2026-2: [API, Relay] Non-constant time password/hash comparison.
—
Fixed in version 4.9.1 ().
-
WSA-2025-7: [Core] Buffer overflow in range of chars in evaluated expressions.
—
Fixed in version 4.6.3 ().
-
WSA-2025-6: [Core] Buffer overflow in base 32 encoding in evaluated expressions.
—
Fixed in version 4.6.3 ().
-
WSA-2025-3: [Core] Integer overflow in conversion of version to an integer number.
—
Fixed in version 4.6.3 ().
-
WSA-2025-2: [Core] Integer overflow in base32 decode/encode functions.
—
Fixed in version 4.6.3 ().
-
WSA-2025-1: [Core] Integer overflow with decimal numbers in calculation of expression.
—
Fixed in version 4.6.3 ().
-
WSA-2024-1: [Core, Plugins] Integer overflow in loops on lists.
—
Fixed in version 4.4.2 ().
Affected by 31 vulnerabilities:
-
WSA-2026-32: [Relay] Denial of service with many passwords in command init received from a relay client.
—
Fixed in version 4.10.4 ().
-
WSA-2026-31: [Relay] Bypass of TOTP and denial of service with invalid TOTP received from a relay client.
—
Fixed in version 4.10.4 ().
-
WSA-2026-30: [Xfer] Incoming files and chats auto-accepted from a nick on the wrong server.
—
Fixed in version 4.10.3 ().
-
WSA-2026-28: [Xfer] Missing checks of the resume position received in DCC RESUME and DCC ACCEPT.
—
Fixed in version 4.10.3 ().
-
WSA-2026-27: [Relay] Denial of service with huge IRC messages received from a relay client.
—
Fixed in version 4.10.3 ().
-
WSA-2026-26: [IRC] Missing checks in SASL authentication with SCRAM mechanisms.
—
Fixed in version 4.10.3 ().
-
WSA-2026-25: [IRC] Evaluation of untrusted strings received from the IRC server or an IRC URL.
—
Fixed in version 4.10.2 ().
-
WSA-2026-24: [Relay] Missing size limit for HTTP headers received from a client.
—
Fixed in version 4.10.2 ().
-
WSA-2026-23: [Core] Heap buffer overflow in charset conversion.
—
Fixed in version 4.10.2 ().
-
WSA-2026-22: [Relay] Heap buffer overflow in path of hdata sent to clients with "weechat" protocol.
—
Fixed in version 4.10.2 ().
-
WSA-2026-21: [IRC] Heap buffer overflow in nick prefixes after a reconnection.
—
Fixed in version 4.10.2 ().
-
WSA-2026-20: [Relay] Missing size limit of data queued for sending to clients.
—
Fixed in version 4.10.1 ().
-
WSA-2026-19: [Relay] Missing rejection of invalid websocket frames.
—
Fixed in version 4.10.1 ().
-
WSA-2026-18: [Relay] Missing size limit for the unterminated Relay text message received from a client.
—
Fixed in version 4.10.1 ().
-
WSA-2026-17: [Xfer] Bypass of user authorization for start of DCC file transfer.
—
Fixed in version 4.10.1 ().
-
WSA-2026-16: [Xfer] Missing size limit for the unterminated Xfer chat message.
—
Fixed in version 4.10.1 ().
-
WSA-2026-15: [Xfer] Write of DCC file received outside of configured download path.
—
Fixed in version 4.10.1 ().
-
WSA-2026-13: [IRC] Use-after-free in the irc plugin when a batched message disconnects the server.
—
Fixed in version 4.9.5 ().
-
WSA-2026-12: [IRC] Stack buffer overflow when building a JOIN command with channel keys.
—
Fixed in version 4.9.5 ().
-
WSA-2026-11: [Logger] Write of logger file outside of configured path.
—
Fixed in version 4.9.4 ().
-
WSA-2026-7: [Xfer] Buffer overflow when receiving a line in a Xfer chat (DCC chat) buffer.
—
Fixed in version 4.9.2 ().
-
WSA-2026-6: [Xfer] Write of DCC file received outside of configured download path.
—
Fixed in version 4.9.2 ().
-
WSA-2026-4: [Relay] Missing size limit for the received websocket frame, HTTP message and HTTP body.
—
Fixed in version 4.9.2 ().
-
WSA-2026-3: [IRC] Missing size limit for the unterminated IRC message or isupport value (message 005).
—
Fixed in version 4.9.2 ().
-
WSA-2026-2: [API, Relay] Non-constant time password/hash comparison.
—
Fixed in version 4.9.1 ().
-
WSA-2025-7: [Core] Buffer overflow in range of chars in evaluated expressions.
—
Fixed in version 4.6.3 ().
-
WSA-2025-6: [Core] Buffer overflow in base 32 encoding in evaluated expressions.
—
Fixed in version 4.6.3 ().
-
WSA-2025-3: [Core] Integer overflow in conversion of version to an integer number.
—
Fixed in version 4.6.3 ().
-
WSA-2025-2: [Core] Integer overflow in base32 decode/encode functions.
—
Fixed in version 4.6.3 ().
-
WSA-2025-1: [Core] Integer overflow with decimal numbers in calculation of expression.
—
Fixed in version 4.6.3 ().
-
WSA-2024-1: [Core, Plugins] Integer overflow in loops on lists.
—
Fixed in version 4.4.2 ().
Affected by 30 vulnerabilities:
-
WSA-2026-32: [Relay] Denial of service with many passwords in command init received from a relay client.
—
Fixed in version 4.10.4 ().
-
WSA-2026-31: [Relay] Bypass of TOTP and denial of service with invalid TOTP received from a relay client.
—
Fixed in version 4.10.4 ().
-
WSA-2026-30: [Xfer] Incoming files and chats auto-accepted from a nick on the wrong server.
—
Fixed in version 4.10.3 ().
-
WSA-2026-28: [Xfer] Missing checks of the resume position received in DCC RESUME and DCC ACCEPT.
—
Fixed in version 4.10.3 ().
-
WSA-2026-27: [Relay] Denial of service with huge IRC messages received from a relay client.
—
Fixed in version 4.10.3 ().
-
WSA-2026-26: [IRC] Missing checks in SASL authentication with SCRAM mechanisms.
—
Fixed in version 4.10.3 ().
-
WSA-2026-25: [IRC] Evaluation of untrusted strings received from the IRC server or an IRC URL.
—
Fixed in version 4.10.2 ().
-
WSA-2026-24: [Relay] Missing size limit for HTTP headers received from a client.
—
Fixed in version 4.10.2 ().
-
WSA-2026-23: [Core] Heap buffer overflow in charset conversion.
—
Fixed in version 4.10.2 ().
-
WSA-2026-22: [Relay] Heap buffer overflow in path of hdata sent to clients with "weechat" protocol.
—
Fixed in version 4.10.2 ().
-
WSA-2026-21: [IRC] Heap buffer overflow in nick prefixes after a reconnection.
—
Fixed in version 4.10.2 ().
-
WSA-2026-20: [Relay] Missing size limit of data queued for sending to clients.
—
Fixed in version 4.10.1 ().
-
WSA-2026-19: [Relay] Missing rejection of invalid websocket frames.
—
Fixed in version 4.10.1 ().
-
WSA-2026-18: [Relay] Missing size limit for the unterminated Relay text message received from a client.
—
Fixed in version 4.10.1 ().
-
WSA-2026-17: [Xfer] Bypass of user authorization for start of DCC file transfer.
—
Fixed in version 4.10.1 ().
-
WSA-2026-16: [Xfer] Missing size limit for the unterminated Xfer chat message.
—
Fixed in version 4.10.1 ().
-
WSA-2026-15: [Xfer] Write of DCC file received outside of configured download path.
—
Fixed in version 4.10.1 ().
-
WSA-2026-12: [IRC] Stack buffer overflow when building a JOIN command with channel keys.
—
Fixed in version 4.9.5 ().
-
WSA-2026-11: [Logger] Write of logger file outside of configured path.
—
Fixed in version 4.9.4 ().
-
WSA-2026-7: [Xfer] Buffer overflow when receiving a line in a Xfer chat (DCC chat) buffer.
—
Fixed in version 4.9.2 ().
-
WSA-2026-6: [Xfer] Write of DCC file received outside of configured download path.
—
Fixed in version 4.9.2 ().
-
WSA-2026-4: [Relay] Missing size limit for the received websocket frame, HTTP message and HTTP body.
—
Fixed in version 4.9.2 ().
-
WSA-2026-3: [IRC] Missing size limit for the unterminated IRC message or isupport value (message 005).
—
Fixed in version 4.9.2 ().
-
WSA-2026-2: [API, Relay] Non-constant time password/hash comparison.
—
Fixed in version 4.9.1 ().
-
WSA-2025-7: [Core] Buffer overflow in range of chars in evaluated expressions.
—
Fixed in version 4.6.3 ().
-
WSA-2025-6: [Core] Buffer overflow in base 32 encoding in evaluated expressions.
—
Fixed in version 4.6.3 ().
-
WSA-2025-3: [Core] Integer overflow in conversion of version to an integer number.
—
Fixed in version 4.6.3 ().
-
WSA-2025-2: [Core] Integer overflow in base32 decode/encode functions.
—
Fixed in version 4.6.3 ().
-
WSA-2025-1: [Core] Integer overflow with decimal numbers in calculation of expression.
—
Fixed in version 4.6.3 ().
-
WSA-2024-1: [Core, Plugins] Integer overflow in loops on lists.
—
Fixed in version 4.4.2 ().
Affected by 29 vulnerabilities:
-
WSA-2026-32: [Relay] Denial of service with many passwords in command init received from a relay client.
—
Fixed in version 4.10.4 ().
-
WSA-2026-31: [Relay] Bypass of TOTP and denial of service with invalid TOTP received from a relay client.
—
Fixed in version 4.10.4 ().
-
WSA-2026-30: [Xfer] Incoming files and chats auto-accepted from a nick on the wrong server.
—
Fixed in version 4.10.3 ().
-
WSA-2026-28: [Xfer] Missing checks of the resume position received in DCC RESUME and DCC ACCEPT.
—
Fixed in version 4.10.3 ().
-
WSA-2026-27: [Relay] Denial of service with huge IRC messages received from a relay client.
—
Fixed in version 4.10.3 ().
-
WSA-2026-26: [IRC] Missing checks in SASL authentication with SCRAM mechanisms.
—
Fixed in version 4.10.3 ().
-
WSA-2026-25: [IRC] Evaluation of untrusted strings received from the IRC server or an IRC URL.
—
Fixed in version 4.10.2 ().
-
WSA-2026-24: [Relay] Missing size limit for HTTP headers received from a client.
—
Fixed in version 4.10.2 ().
-
WSA-2026-23: [Core] Heap buffer overflow in charset conversion.
—
Fixed in version 4.10.2 ().
-
WSA-2026-22: [Relay] Heap buffer overflow in path of hdata sent to clients with "weechat" protocol.
—
Fixed in version 4.10.2 ().
-
WSA-2026-21: [IRC] Heap buffer overflow in nick prefixes after a reconnection.
—
Fixed in version 4.10.2 ().
-
WSA-2026-20: [Relay] Missing size limit of data queued for sending to clients.
—
Fixed in version 4.10.1 ().
-
WSA-2026-19: [Relay] Missing rejection of invalid websocket frames.
—
Fixed in version 4.10.1 ().
-
WSA-2026-18: [Relay] Missing size limit for the unterminated Relay text message received from a client.
—
Fixed in version 4.10.1 ().
-
WSA-2026-17: [Xfer] Bypass of user authorization for start of DCC file transfer.
—
Fixed in version 4.10.1 ().
-
WSA-2026-16: [Xfer] Missing size limit for the unterminated Xfer chat message.
—
Fixed in version 4.10.1 ().
-
WSA-2026-15: [Xfer] Write of DCC file received outside of configured download path.
—
Fixed in version 4.10.1 ().
-
WSA-2026-12: [IRC] Stack buffer overflow when building a JOIN command with channel keys.
—
Fixed in version 4.9.5 ().
-
WSA-2026-11: [Logger] Write of logger file outside of configured path.
—
Fixed in version 4.9.4 ().
-
WSA-2026-7: [Xfer] Buffer overflow when receiving a line in a Xfer chat (DCC chat) buffer.
—
Fixed in version 4.9.2 ().
-
WSA-2026-6: [Xfer] Write of DCC file received outside of configured download path.
—
Fixed in version 4.9.2 ().
-
WSA-2026-4: [Relay] Missing size limit for the received websocket frame, HTTP message and HTTP body.
—
Fixed in version 4.9.2 ().
-
WSA-2026-3: [IRC] Missing size limit for the unterminated IRC message or isupport value (message 005).
—
Fixed in version 4.9.2 ().
-
WSA-2026-2: [API, Relay] Non-constant time password/hash comparison.
—
Fixed in version 4.9.1 ().
-
WSA-2025-6: [Core] Buffer overflow in base 32 encoding in evaluated expressions.
—
Fixed in version 4.6.3 ().
-
WSA-2025-3: [Core] Integer overflow in conversion of version to an integer number.
—
Fixed in version 4.6.3 ().
-
WSA-2025-2: [Core] Integer overflow in base32 decode/encode functions.
—
Fixed in version 4.6.3 ().
-
WSA-2025-1: [Core] Integer overflow with decimal numbers in calculation of expression.
—
Fixed in version 4.6.3 ().
-
WSA-2024-1: [Core, Plugins] Integer overflow in loops on lists.
—
Fixed in version 4.4.2 ().
Affected by 29 vulnerabilities:
-
WSA-2026-32: [Relay] Denial of service with many passwords in command init received from a relay client.
—
Fixed in version 4.10.4 ().
-
WSA-2026-31: [Relay] Bypass of TOTP and denial of service with invalid TOTP received from a relay client.
—
Fixed in version 4.10.4 ().
-
WSA-2026-30: [Xfer] Incoming files and chats auto-accepted from a nick on the wrong server.
—
Fixed in version 4.10.3 ().
-
WSA-2026-28: [Xfer] Missing checks of the resume position received in DCC RESUME and DCC ACCEPT.
—
Fixed in version 4.10.3 ().
-
WSA-2026-27: [Relay] Denial of service with huge IRC messages received from a relay client.
—
Fixed in version 4.10.3 ().
-
WSA-2026-26: [IRC] Missing checks in SASL authentication with SCRAM mechanisms.
—
Fixed in version 4.10.3 ().
-
WSA-2026-25: [IRC] Evaluation of untrusted strings received from the IRC server or an IRC URL.
—
Fixed in version 4.10.2 ().
-
WSA-2026-24: [Relay] Missing size limit for HTTP headers received from a client.
—
Fixed in version 4.10.2 ().
-
WSA-2026-23: [Core] Heap buffer overflow in charset conversion.
—
Fixed in version 4.10.2 ().
-
WSA-2026-22: [Relay] Heap buffer overflow in path of hdata sent to clients with "weechat" protocol.
—
Fixed in version 4.10.2 ().
-
WSA-2026-21: [IRC] Heap buffer overflow in nick prefixes after a reconnection.
—
Fixed in version 4.10.2 ().
-
WSA-2026-20: [Relay] Missing size limit of data queued for sending to clients.
—
Fixed in version 4.10.1 ().
-
WSA-2026-19: [Relay] Missing rejection of invalid websocket frames.
—
Fixed in version 4.10.1 ().
-
WSA-2026-18: [Relay] Missing size limit for the unterminated Relay text message received from a client.
—
Fixed in version 4.10.1 ().
-
WSA-2026-17: [Xfer] Bypass of user authorization for start of DCC file transfer.
—
Fixed in version 4.10.1 ().
-
WSA-2026-16: [Xfer] Missing size limit for the unterminated Xfer chat message.
—
Fixed in version 4.10.1 ().
-
WSA-2026-15: [Xfer] Write of DCC file received outside of configured download path.
—
Fixed in version 4.10.1 ().
-
WSA-2026-12: [IRC] Stack buffer overflow when building a JOIN command with channel keys.
—
Fixed in version 4.9.5 ().
-
WSA-2026-11: [Logger] Write of logger file outside of configured path.
—
Fixed in version 4.9.4 ().
-
WSA-2026-7: [Xfer] Buffer overflow when receiving a line in a Xfer chat (DCC chat) buffer.
—
Fixed in version 4.9.2 ().
-
WSA-2026-6: [Xfer] Write of DCC file received outside of configured download path.
—
Fixed in version 4.9.2 ().
-
WSA-2026-4: [Relay] Missing size limit for the received websocket frame, HTTP message and HTTP body.
—
Fixed in version 4.9.2 ().
-
WSA-2026-3: [IRC] Missing size limit for the unterminated IRC message or isupport value (message 005).
—
Fixed in version 4.9.2 ().
-
WSA-2026-2: [API, Relay] Non-constant time password/hash comparison.
—
Fixed in version 4.9.1 ().
-
WSA-2025-6: [Core] Buffer overflow in base 32 encoding in evaluated expressions.
—
Fixed in version 4.6.3 ().
-
WSA-2025-3: [Core] Integer overflow in conversion of version to an integer number.
—
Fixed in version 4.6.3 ().
-
WSA-2025-2: [Core] Integer overflow in base32 decode/encode functions.
—
Fixed in version 4.6.3 ().
-
WSA-2025-1: [Core] Integer overflow with decimal numbers in calculation of expression.
—
Fixed in version 4.6.3 ().
-
WSA-2024-1: [Core, Plugins] Integer overflow in loops on lists.
—
Fixed in version 4.4.2 ().
Affected by 29 vulnerabilities:
-
WSA-2026-32: [Relay] Denial of service with many passwords in command init received from a relay client.
—
Fixed in version 4.10.4 ().
-
WSA-2026-31: [Relay] Bypass of TOTP and denial of service with invalid TOTP received from a relay client.
—
Fixed in version 4.10.4 ().
-
WSA-2026-30: [Xfer] Incoming files and chats auto-accepted from a nick on the wrong server.
—
Fixed in version 4.10.3 ().
-
WSA-2026-28: [Xfer] Missing checks of the resume position received in DCC RESUME and DCC ACCEPT.
—
Fixed in version 4.10.3 ().
-
WSA-2026-27: [Relay] Denial of service with huge IRC messages received from a relay client.
—
Fixed in version 4.10.3 ().
-
WSA-2026-26: [IRC] Missing checks in SASL authentication with SCRAM mechanisms.
—
Fixed in version 4.10.3 ().
-
WSA-2026-25: [IRC] Evaluation of untrusted strings received from the IRC server or an IRC URL.
—
Fixed in version 4.10.2 ().
-
WSA-2026-24: [Relay] Missing size limit for HTTP headers received from a client.
—
Fixed in version 4.10.2 ().
-
WSA-2026-23: [Core] Heap buffer overflow in charset conversion.
—
Fixed in version 4.10.2 ().
-
WSA-2026-22: [Relay] Heap buffer overflow in path of hdata sent to clients with "weechat" protocol.
—
Fixed in version 4.10.2 ().
-
WSA-2026-21: [IRC] Heap buffer overflow in nick prefixes after a reconnection.
—
Fixed in version 4.10.2 ().
-
WSA-2026-20: [Relay] Missing size limit of data queued for sending to clients.
—
Fixed in version 4.10.1 ().
-
WSA-2026-19: [Relay] Missing rejection of invalid websocket frames.
—
Fixed in version 4.10.1 ().
-
WSA-2026-18: [Relay] Missing size limit for the unterminated Relay text message received from a client.
—
Fixed in version 4.10.1 ().
-
WSA-2026-17: [Xfer] Bypass of user authorization for start of DCC file transfer.
—
Fixed in version 4.10.1 ().
-
WSA-2026-16: [Xfer] Missing size limit for the unterminated Xfer chat message.
—
Fixed in version 4.10.1 ().
-
WSA-2026-15: [Xfer] Write of DCC file received outside of configured download path.
—
Fixed in version 4.10.1 ().
-
WSA-2026-12: [IRC] Stack buffer overflow when building a JOIN command with channel keys.
—
Fixed in version 4.9.5 ().
-
WSA-2026-11: [Logger] Write of logger file outside of configured path.
—
Fixed in version 4.9.4 ().
-
WSA-2026-7: [Xfer] Buffer overflow when receiving a line in a Xfer chat (DCC chat) buffer.
—
Fixed in version 4.9.2 ().
-
WSA-2026-6: [Xfer] Write of DCC file received outside of configured download path.
—
Fixed in version 4.9.2 ().
-
WSA-2026-4: [Relay] Missing size limit for the received websocket frame, HTTP message and HTTP body.
—
Fixed in version 4.9.2 ().
-
WSA-2026-3: [IRC] Missing size limit for the unterminated IRC message or isupport value (message 005).
—
Fixed in version 4.9.2 ().
-
WSA-2026-2: [API, Relay] Non-constant time password/hash comparison.
—
Fixed in version 4.9.1 ().
-
WSA-2025-6: [Core] Buffer overflow in base 32 encoding in evaluated expressions.
—
Fixed in version 4.6.3 ().
-
WSA-2025-3: [Core] Integer overflow in conversion of version to an integer number.
—
Fixed in version 4.6.3 ().
-
WSA-2025-2: [Core] Integer overflow in base32 decode/encode functions.
—
Fixed in version 4.6.3 ().
-
WSA-2025-1: [Core] Integer overflow with decimal numbers in calculation of expression.
—
Fixed in version 4.6.3 ().
-
WSA-2024-1: [Core, Plugins] Integer overflow in loops on lists.
—
Fixed in version 4.4.2 ().
Affected by 29 vulnerabilities:
-
WSA-2026-32: [Relay] Denial of service with many passwords in command init received from a relay client.
—
Fixed in version 4.10.4 ().
-
WSA-2026-31: [Relay] Bypass of TOTP and denial of service with invalid TOTP received from a relay client.
—
Fixed in version 4.10.4 ().
-
WSA-2026-30: [Xfer] Incoming files and chats auto-accepted from a nick on the wrong server.
—
Fixed in version 4.10.3 ().
-
WSA-2026-28: [Xfer] Missing checks of the resume position received in DCC RESUME and DCC ACCEPT.
—
Fixed in version 4.10.3 ().
-
WSA-2026-27: [Relay] Denial of service with huge IRC messages received from a relay client.
—
Fixed in version 4.10.3 ().
-
WSA-2026-26: [IRC] Missing checks in SASL authentication with SCRAM mechanisms.
—
Fixed in version 4.10.3 ().
-
WSA-2026-25: [IRC] Evaluation of untrusted strings received from the IRC server or an IRC URL.
—
Fixed in version 4.10.2 ().
-
WSA-2026-24: [Relay] Missing size limit for HTTP headers received from a client.
—
Fixed in version 4.10.2 ().
-
WSA-2026-23: [Core] Heap buffer overflow in charset conversion.
—
Fixed in version 4.10.2 ().
-
WSA-2026-22: [Relay] Heap buffer overflow in path of hdata sent to clients with "weechat" protocol.
—
Fixed in version 4.10.2 ().
-
WSA-2026-21: [IRC] Heap buffer overflow in nick prefixes after a reconnection.
—
Fixed in version 4.10.2 ().
-
WSA-2026-20: [Relay] Missing size limit of data queued for sending to clients.
—
Fixed in version 4.10.1 ().
-
WSA-2026-19: [Relay] Missing rejection of invalid websocket frames.
—
Fixed in version 4.10.1 ().
-
WSA-2026-18: [Relay] Missing size limit for the unterminated Relay text message received from a client.
—
Fixed in version 4.10.1 ().
-
WSA-2026-17: [Xfer] Bypass of user authorization for start of DCC file transfer.
—
Fixed in version 4.10.1 ().
-
WSA-2026-16: [Xfer] Missing size limit for the unterminated Xfer chat message.
—
Fixed in version 4.10.1 ().
-
WSA-2026-15: [Xfer] Write of DCC file received outside of configured download path.
—
Fixed in version 4.10.1 ().
-
WSA-2026-12: [IRC] Stack buffer overflow when building a JOIN command with channel keys.
—
Fixed in version 4.9.5 ().
-
WSA-2026-11: [Logger] Write of logger file outside of configured path.
—
Fixed in version 4.9.4 ().
-
WSA-2026-7: [Xfer] Buffer overflow when receiving a line in a Xfer chat (DCC chat) buffer.
—
Fixed in version 4.9.2 ().
-
WSA-2026-6: [Xfer] Write of DCC file received outside of configured download path.
—
Fixed in version 4.9.2 ().
-
WSA-2026-4: [Relay] Missing size limit for the received websocket frame, HTTP message and HTTP body.
—
Fixed in version 4.9.2 ().
-
WSA-2026-3: [IRC] Missing size limit for the unterminated IRC message or isupport value (message 005).
—
Fixed in version 4.9.2 ().
-
WSA-2026-2: [API, Relay] Non-constant time password/hash comparison.
—
Fixed in version 4.9.1 ().
-
WSA-2025-6: [Core] Buffer overflow in base 32 encoding in evaluated expressions.
—
Fixed in version 4.6.3 ().
-
WSA-2025-3: [Core] Integer overflow in conversion of version to an integer number.
—
Fixed in version 4.6.3 ().
-
WSA-2025-2: [Core] Integer overflow in base32 decode/encode functions.
—
Fixed in version 4.6.3 ().
-
WSA-2025-1: [Core] Integer overflow with decimal numbers in calculation of expression.
—
Fixed in version 4.6.3 ().
-
WSA-2024-1: [Core, Plugins] Integer overflow in loops on lists.
—
Fixed in version 4.4.2 ().
Affected by 29 vulnerabilities:
-
WSA-2026-32: [Relay] Denial of service with many passwords in command init received from a relay client.
—
Fixed in version 4.10.4 ().
-
WSA-2026-31: [Relay] Bypass of TOTP and denial of service with invalid TOTP received from a relay client.
—
Fixed in version 4.10.4 ().
-
WSA-2026-30: [Xfer] Incoming files and chats auto-accepted from a nick on the wrong server.
—
Fixed in version 4.10.3 ().
-
WSA-2026-28: [Xfer] Missing checks of the resume position received in DCC RESUME and DCC ACCEPT.
—
Fixed in version 4.10.3 ().
-
WSA-2026-27: [Relay] Denial of service with huge IRC messages received from a relay client.
—
Fixed in version 4.10.3 ().
-
WSA-2026-26: [IRC] Missing checks in SASL authentication with SCRAM mechanisms.
—
Fixed in version 4.10.3 ().
-
WSA-2026-25: [IRC] Evaluation of untrusted strings received from the IRC server or an IRC URL.
—
Fixed in version 4.10.2 ().
-
WSA-2026-24: [Relay] Missing size limit for HTTP headers received from a client.
—
Fixed in version 4.10.2 ().
-
WSA-2026-23: [Core] Heap buffer overflow in charset conversion.
—
Fixed in version 4.10.2 ().
-
WSA-2026-22: [Relay] Heap buffer overflow in path of hdata sent to clients with "weechat" protocol.
—
Fixed in version 4.10.2 ().
-
WSA-2026-21: [IRC] Heap buffer overflow in nick prefixes after a reconnection.
—
Fixed in version 4.10.2 ().
-
WSA-2026-20: [Relay] Missing size limit of data queued for sending to clients.
—
Fixed in version 4.10.1 ().
-
WSA-2026-19: [Relay] Missing rejection of invalid websocket frames.
—
Fixed in version 4.10.1 ().
-
WSA-2026-18: [Relay] Missing size limit for the unterminated Relay text message received from a client.
—
Fixed in version 4.10.1 ().
-
WSA-2026-17: [Xfer] Bypass of user authorization for start of DCC file transfer.
—
Fixed in version 4.10.1 ().
-
WSA-2026-16: [Xfer] Missing size limit for the unterminated Xfer chat message.
—
Fixed in version 4.10.1 ().
-
WSA-2026-15: [Xfer] Write of DCC file received outside of configured download path.
—
Fixed in version 4.10.1 ().
-
WSA-2026-12: [IRC] Stack buffer overflow when building a JOIN command with channel keys.
—
Fixed in version 4.9.5 ().
-
WSA-2026-11: [Logger] Write of logger file outside of configured path.
—
Fixed in version 4.9.4 ().
-
WSA-2026-7: [Xfer] Buffer overflow when receiving a line in a Xfer chat (DCC chat) buffer.
—
Fixed in version 4.9.2 ().
-
WSA-2026-6: [Xfer] Write of DCC file received outside of configured download path.
—
Fixed in version 4.9.2 ().
-
WSA-2026-4: [Relay] Missing size limit for the received websocket frame, HTTP message and HTTP body.
—
Fixed in version 4.9.2 ().
-
WSA-2026-3: [IRC] Missing size limit for the unterminated IRC message or isupport value (message 005).
—
Fixed in version 4.9.2 ().
-
WSA-2026-2: [API, Relay] Non-constant time password/hash comparison.
—
Fixed in version 4.9.1 ().
-
WSA-2025-6: [Core] Buffer overflow in base 32 encoding in evaluated expressions.
—
Fixed in version 4.6.3 ().
-
WSA-2025-3: [Core] Integer overflow in conversion of version to an integer number.
—
Fixed in version 4.6.3 ().
-
WSA-2025-2: [Core] Integer overflow in base32 decode/encode functions.
—
Fixed in version 4.6.3 ().
-
WSA-2025-1: [Core] Integer overflow with decimal numbers in calculation of expression.
—
Fixed in version 4.6.3 ().
-
WSA-2024-1: [Core, Plugins] Integer overflow in loops on lists.
—
Fixed in version 4.4.2 ().
Affected by 30 vulnerabilities:
-
WSA-2026-32: [Relay] Denial of service with many passwords in command init received from a relay client.
—
Fixed in version 4.10.4 ().
-
WSA-2026-31: [Relay] Bypass of TOTP and denial of service with invalid TOTP received from a relay client.
—
Fixed in version 4.10.4 ().
-
WSA-2026-30: [Xfer] Incoming files and chats auto-accepted from a nick on the wrong server.
—
Fixed in version 4.10.3 ().
-
WSA-2026-28: [Xfer] Missing checks of the resume position received in DCC RESUME and DCC ACCEPT.
—
Fixed in version 4.10.3 ().
-
WSA-2026-27: [Relay] Denial of service with huge IRC messages received from a relay client.
—
Fixed in version 4.10.3 ().
-
WSA-2026-26: [IRC] Missing checks in SASL authentication with SCRAM mechanisms.
—
Fixed in version 4.10.3 ().
-
WSA-2026-25: [IRC] Evaluation of untrusted strings received from the IRC server or an IRC URL.
—
Fixed in version 4.10.2 ().
-
WSA-2026-24: [Relay] Missing size limit for HTTP headers received from a client.
—
Fixed in version 4.10.2 ().
-
WSA-2026-23: [Core] Heap buffer overflow in charset conversion.
—
Fixed in version 4.10.2 ().
-
WSA-2026-22: [Relay] Heap buffer overflow in path of hdata sent to clients with "weechat" protocol.
—
Fixed in version 4.10.2 ().
-
WSA-2026-21: [IRC] Heap buffer overflow in nick prefixes after a reconnection.
—
Fixed in version 4.10.2 ().
-
WSA-2026-20: [Relay] Missing size limit of data queued for sending to clients.
—
Fixed in version 4.10.1 ().
-
WSA-2026-19: [Relay] Missing rejection of invalid websocket frames.
—
Fixed in version 4.10.1 ().
-
WSA-2026-18: [Relay] Missing size limit for the unterminated Relay text message received from a client.
—
Fixed in version 4.10.1 ().
-
WSA-2026-17: [Xfer] Bypass of user authorization for start of DCC file transfer.
—
Fixed in version 4.10.1 ().
-
WSA-2026-16: [Xfer] Missing size limit for the unterminated Xfer chat message.
—
Fixed in version 4.10.1 ().
-
WSA-2026-15: [Xfer] Write of DCC file received outside of configured download path.
—
Fixed in version 4.10.1 ().
-
WSA-2026-12: [IRC] Stack buffer overflow when building a JOIN command with channel keys.
—
Fixed in version 4.9.5 ().
-
WSA-2026-11: [Logger] Write of logger file outside of configured path.
—
Fixed in version 4.9.4 ().
-
WSA-2026-7: [Xfer] Buffer overflow when receiving a line in a Xfer chat (DCC chat) buffer.
—
Fixed in version 4.9.2 ().
-
WSA-2026-6: [Xfer] Write of DCC file received outside of configured download path.
—
Fixed in version 4.9.2 ().
-
WSA-2026-4: [Relay] Missing size limit for the received websocket frame, HTTP message and HTTP body.
—
Fixed in version 4.9.2 ().
-
WSA-2026-3: [IRC] Missing size limit for the unterminated IRC message or isupport value (message 005).
—
Fixed in version 4.9.2 ().
-
WSA-2026-2: [API, Relay] Non-constant time password/hash comparison.
—
Fixed in version 4.9.1 ().
-
WSA-2025-6: [Core] Buffer overflow in base 32 encoding in evaluated expressions.
—
Fixed in version 4.6.3 ().
-
WSA-2025-3: [Core] Integer overflow in conversion of version to an integer number.
—
Fixed in version 4.6.3 ().
-
WSA-2025-2: [Core] Integer overflow in base32 decode/encode functions.
—
Fixed in version 4.6.3 ().
-
WSA-2025-1: [Core] Integer overflow with decimal numbers in calculation of expression.
—
Fixed in version 4.6.3 ().
-
WSA-2024-1: [Core, Plugins] Integer overflow in loops on lists.
—
Fixed in version 4.4.2 ().
-
WSA-2022-1: [IRC, Plugins] Possible man-in-the-middle attack in TLS connection to servers.
—
Fixed in version 3.4.1 ().
Affected by 30 vulnerabilities:
-
WSA-2026-32: [Relay] Denial of service with many passwords in command init received from a relay client.
—
Fixed in version 4.10.4 ().
-
WSA-2026-31: [Relay] Bypass of TOTP and denial of service with invalid TOTP received from a relay client.
—
Fixed in version 4.10.4 ().
-
WSA-2026-30: [Xfer] Incoming files and chats auto-accepted from a nick on the wrong server.
—
Fixed in version 4.10.3 ().
-
WSA-2026-28: [Xfer] Missing checks of the resume position received in DCC RESUME and DCC ACCEPT.
—
Fixed in version 4.10.3 ().
-
WSA-2026-27: [Relay] Denial of service with huge IRC messages received from a relay client.
—
Fixed in version 4.10.3 ().
-
WSA-2026-26: [IRC] Missing checks in SASL authentication with SCRAM mechanisms.
—
Fixed in version 4.10.3 ().
-
WSA-2026-25: [IRC] Evaluation of untrusted strings received from the IRC server or an IRC URL.
—
Fixed in version 4.10.2 ().
-
WSA-2026-24: [Relay] Missing size limit for HTTP headers received from a client.
—
Fixed in version 4.10.2 ().
-
WSA-2026-23: [Core] Heap buffer overflow in charset conversion.
—
Fixed in version 4.10.2 ().
-
WSA-2026-22: [Relay] Heap buffer overflow in path of hdata sent to clients with "weechat" protocol.
—
Fixed in version 4.10.2 ().
-
WSA-2026-21: [IRC] Heap buffer overflow in nick prefixes after a reconnection.
—
Fixed in version 4.10.2 ().
-
WSA-2026-20: [Relay] Missing size limit of data queued for sending to clients.
—
Fixed in version 4.10.1 ().
-
WSA-2026-19: [Relay] Missing rejection of invalid websocket frames.
—
Fixed in version 4.10.1 ().
-
WSA-2026-18: [Relay] Missing size limit for the unterminated Relay text message received from a client.
—
Fixed in version 4.10.1 ().
-
WSA-2026-17: [Xfer] Bypass of user authorization for start of DCC file transfer.
—
Fixed in version 4.10.1 ().
-
WSA-2026-16: [Xfer] Missing size limit for the unterminated Xfer chat message.
—
Fixed in version 4.10.1 ().
-
WSA-2026-15: [Xfer] Write of DCC file received outside of configured download path.
—
Fixed in version 4.10.1 ().
-
WSA-2026-12: [IRC] Stack buffer overflow when building a JOIN command with channel keys.
—
Fixed in version 4.9.5 ().
-
WSA-2026-11: [Logger] Write of logger file outside of configured path.
—
Fixed in version 4.9.4 ().
-
WSA-2026-7: [Xfer] Buffer overflow when receiving a line in a Xfer chat (DCC chat) buffer.
—
Fixed in version 4.9.2 ().
-
WSA-2026-6: [Xfer] Write of DCC file received outside of configured download path.
—
Fixed in version 4.9.2 ().
-
WSA-2026-4: [Relay] Missing size limit for the received websocket frame, HTTP message and HTTP body.
—
Fixed in version 4.9.2 ().
-
WSA-2026-3: [IRC] Missing size limit for the unterminated IRC message or isupport value (message 005).
—
Fixed in version 4.9.2 ().
-
WSA-2026-2: [API, Relay] Non-constant time password/hash comparison.
—
Fixed in version 4.9.1 ().
-
WSA-2025-6: [Core] Buffer overflow in base 32 encoding in evaluated expressions.
—
Fixed in version 4.6.3 ().
-
WSA-2025-3: [Core] Integer overflow in conversion of version to an integer number.
—
Fixed in version 4.6.3 ().
-
WSA-2025-2: [Core] Integer overflow in base32 decode/encode functions.
—
Fixed in version 4.6.3 ().
-
WSA-2025-1: [Core] Integer overflow with decimal numbers in calculation of expression.
—
Fixed in version 4.6.3 ().
-
WSA-2024-1: [Core, Plugins] Integer overflow in loops on lists.
—
Fixed in version 4.4.2 ().
-
WSA-2022-1: [IRC, Plugins] Possible man-in-the-middle attack in TLS connection to servers.
—
Fixed in version 3.4.1 ().
Affected by 30 vulnerabilities:
-
WSA-2026-32: [Relay] Denial of service with many passwords in command init received from a relay client.
—
Fixed in version 4.10.4 ().
-
WSA-2026-31: [Relay] Bypass of TOTP and denial of service with invalid TOTP received from a relay client.
—
Fixed in version 4.10.4 ().
-
WSA-2026-30: [Xfer] Incoming files and chats auto-accepted from a nick on the wrong server.
—
Fixed in version 4.10.3 ().
-
WSA-2026-28: [Xfer] Missing checks of the resume position received in DCC RESUME and DCC ACCEPT.
—
Fixed in version 4.10.3 ().
-
WSA-2026-27: [Relay] Denial of service with huge IRC messages received from a relay client.
—
Fixed in version 4.10.3 ().
-
WSA-2026-26: [IRC] Missing checks in SASL authentication with SCRAM mechanisms.
—
Fixed in version 4.10.3 ().
-
WSA-2026-25: [IRC] Evaluation of untrusted strings received from the IRC server or an IRC URL.
—
Fixed in version 4.10.2 ().
-
WSA-2026-24: [Relay] Missing size limit for HTTP headers received from a client.
—
Fixed in version 4.10.2 ().
-
WSA-2026-23: [Core] Heap buffer overflow in charset conversion.
—
Fixed in version 4.10.2 ().
-
WSA-2026-22: [Relay] Heap buffer overflow in path of hdata sent to clients with "weechat" protocol.
—
Fixed in version 4.10.2 ().
-
WSA-2026-21: [IRC] Heap buffer overflow in nick prefixes after a reconnection.
—
Fixed in version 4.10.2 ().
-
WSA-2026-20: [Relay] Missing size limit of data queued for sending to clients.
—
Fixed in version 4.10.1 ().
-
WSA-2026-19: [Relay] Missing rejection of invalid websocket frames.
—
Fixed in version 4.10.1 ().
-
WSA-2026-18: [Relay] Missing size limit for the unterminated Relay text message received from a client.
—
Fixed in version 4.10.1 ().
-
WSA-2026-17: [Xfer] Bypass of user authorization for start of DCC file transfer.
—
Fixed in version 4.10.1 ().
-
WSA-2026-16: [Xfer] Missing size limit for the unterminated Xfer chat message.
—
Fixed in version 4.10.1 ().
-
WSA-2026-15: [Xfer] Write of DCC file received outside of configured download path.
—
Fixed in version 4.10.1 ().
-
WSA-2026-12: [IRC] Stack buffer overflow when building a JOIN command with channel keys.
—
Fixed in version 4.9.5 ().
-
WSA-2026-11: [Logger] Write of logger file outside of configured path.
—
Fixed in version 4.9.4 ().
-
WSA-2026-7: [Xfer] Buffer overflow when receiving a line in a Xfer chat (DCC chat) buffer.
—
Fixed in version 4.9.2 ().
-
WSA-2026-6: [Xfer] Write of DCC file received outside of configured download path.
—
Fixed in version 4.9.2 ().
-
WSA-2026-4: [Relay] Missing size limit for the received websocket frame, HTTP message and HTTP body.
—
Fixed in version 4.9.2 ().
-
WSA-2026-3: [IRC] Missing size limit for the unterminated IRC message or isupport value (message 005).
—
Fixed in version 4.9.2 ().
-
WSA-2026-2: [API, Relay] Non-constant time password/hash comparison.
—
Fixed in version 4.9.1 ().
-
WSA-2025-6: [Core] Buffer overflow in base 32 encoding in evaluated expressions.
—
Fixed in version 4.6.3 ().
-
WSA-2025-3: [Core] Integer overflow in conversion of version to an integer number.
—
Fixed in version 4.6.3 ().
-
WSA-2025-2: [Core] Integer overflow in base32 decode/encode functions.
—
Fixed in version 4.6.3 ().
-
WSA-2025-1: [Core] Integer overflow with decimal numbers in calculation of expression.
—
Fixed in version 4.6.3 ().
-
WSA-2024-1: [Core, Plugins] Integer overflow in loops on lists.
—
Fixed in version 4.4.2 ().
-
WSA-2022-1: [IRC, Plugins] Possible man-in-the-middle attack in TLS connection to servers.
—
Fixed in version 3.4.1 ().
Affected by 31 vulnerabilities:
-
WSA-2026-32: [Relay] Denial of service with many passwords in command init received from a relay client.
—
Fixed in version 4.10.4 ().
-
WSA-2026-31: [Relay] Bypass of TOTP and denial of service with invalid TOTP received from a relay client.
—
Fixed in version 4.10.4 ().
-
WSA-2026-30: [Xfer] Incoming files and chats auto-accepted from a nick on the wrong server.
—
Fixed in version 4.10.3 ().
-
WSA-2026-28: [Xfer] Missing checks of the resume position received in DCC RESUME and DCC ACCEPT.
—
Fixed in version 4.10.3 ().
-
WSA-2026-27: [Relay] Denial of service with huge IRC messages received from a relay client.
—
Fixed in version 4.10.3 ().
-
WSA-2026-26: [IRC] Missing checks in SASL authentication with SCRAM mechanisms.
—
Fixed in version 4.10.3 ().
-
WSA-2026-25: [IRC] Evaluation of untrusted strings received from the IRC server or an IRC URL.
—
Fixed in version 4.10.2 ().
-
WSA-2026-24: [Relay] Missing size limit for HTTP headers received from a client.
—
Fixed in version 4.10.2 ().
-
WSA-2026-23: [Core] Heap buffer overflow in charset conversion.
—
Fixed in version 4.10.2 ().
-
WSA-2026-22: [Relay] Heap buffer overflow in path of hdata sent to clients with "weechat" protocol.
—
Fixed in version 4.10.2 ().
-
WSA-2026-21: [IRC] Heap buffer overflow in nick prefixes after a reconnection.
—
Fixed in version 4.10.2 ().
-
WSA-2026-20: [Relay] Missing size limit of data queued for sending to clients.
—
Fixed in version 4.10.1 ().
-
WSA-2026-19: [Relay] Missing rejection of invalid websocket frames.
—
Fixed in version 4.10.1 ().
-
WSA-2026-18: [Relay] Missing size limit for the unterminated Relay text message received from a client.
—
Fixed in version 4.10.1 ().
-
WSA-2026-17: [Xfer] Bypass of user authorization for start of DCC file transfer.
—
Fixed in version 4.10.1 ().
-
WSA-2026-16: [Xfer] Missing size limit for the unterminated Xfer chat message.
—
Fixed in version 4.10.1 ().
-
WSA-2026-15: [Xfer] Write of DCC file received outside of configured download path.
—
Fixed in version 4.10.1 ().
-
WSA-2026-12: [IRC] Stack buffer overflow when building a JOIN command with channel keys.
—
Fixed in version 4.9.5 ().
-
WSA-2026-11: [Logger] Write of logger file outside of configured path.
—
Fixed in version 4.9.4 ().
-
WSA-2026-7: [Xfer] Buffer overflow when receiving a line in a Xfer chat (DCC chat) buffer.
—
Fixed in version 4.9.2 ().
-
WSA-2026-6: [Xfer] Write of DCC file received outside of configured download path.
—
Fixed in version 4.9.2 ().
-
WSA-2026-4: [Relay] Missing size limit for the received websocket frame, HTTP message and HTTP body.
—
Fixed in version 4.9.2 ().
-
WSA-2026-3: [IRC] Missing size limit for the unterminated IRC message or isupport value (message 005).
—
Fixed in version 4.9.2 ().
-
WSA-2026-2: [API, Relay] Non-constant time password/hash comparison.
—
Fixed in version 4.9.1 ().
-
WSA-2025-6: [Core] Buffer overflow in base 32 encoding in evaluated expressions.
—
Fixed in version 4.6.3 ().
-
WSA-2025-3: [Core] Integer overflow in conversion of version to an integer number.
—
Fixed in version 4.6.3 ().
-
WSA-2025-2: [Core] Integer overflow in base32 decode/encode functions.
—
Fixed in version 4.6.3 ().
-
WSA-2025-1: [Core] Integer overflow with decimal numbers in calculation of expression.
—
Fixed in version 4.6.3 ().
-
WSA-2024-1: [Core, Plugins] Integer overflow in loops on lists.
—
Fixed in version 4.4.2 ().
-
WSA-2022-1: [IRC, Plugins] Possible man-in-the-middle attack in TLS connection to servers.
—
Fixed in version 3.4.1 ().
-
WSA-2021-1: [Relay] Crash on malformed websocket frame in relay plugin.
—
Fixed in version 3.2.1 ().
Affected by 29 vulnerabilities:
-
WSA-2026-32: [Relay] Denial of service with many passwords in command init received from a relay client.
—
Fixed in version 4.10.4 ().
-
WSA-2026-31: [Relay] Bypass of TOTP and denial of service with invalid TOTP received from a relay client.
—
Fixed in version 4.10.4 ().
-
WSA-2026-30: [Xfer] Incoming files and chats auto-accepted from a nick on the wrong server.
—
Fixed in version 4.10.3 ().
-
WSA-2026-28: [Xfer] Missing checks of the resume position received in DCC RESUME and DCC ACCEPT.
—
Fixed in version 4.10.3 ().
-
WSA-2026-27: [Relay] Denial of service with huge IRC messages received from a relay client.
—
Fixed in version 4.10.3 ().
-
WSA-2026-25: [IRC] Evaluation of untrusted strings received from the IRC server or an IRC URL.
—
Fixed in version 4.10.2 ().
-
WSA-2026-24: [Relay] Missing size limit for HTTP headers received from a client.
—
Fixed in version 4.10.2 ().
-
WSA-2026-23: [Core] Heap buffer overflow in charset conversion.
—
Fixed in version 4.10.2 ().
-
WSA-2026-22: [Relay] Heap buffer overflow in path of hdata sent to clients with "weechat" protocol.
—
Fixed in version 4.10.2 ().
-
WSA-2026-21: [IRC] Heap buffer overflow in nick prefixes after a reconnection.
—
Fixed in version 4.10.2 ().
-
WSA-2026-20: [Relay] Missing size limit of data queued for sending to clients.
—
Fixed in version 4.10.1 ().
-
WSA-2026-19: [Relay] Missing rejection of invalid websocket frames.
—
Fixed in version 4.10.1 ().
-
WSA-2026-18: [Relay] Missing size limit for the unterminated Relay text message received from a client.
—
Fixed in version 4.10.1 ().
-
WSA-2026-17: [Xfer] Bypass of user authorization for start of DCC file transfer.
—
Fixed in version 4.10.1 ().
-
WSA-2026-16: [Xfer] Missing size limit for the unterminated Xfer chat message.
—
Fixed in version 4.10.1 ().
-
WSA-2026-15: [Xfer] Write of DCC file received outside of configured download path.
—
Fixed in version 4.10.1 ().
-
WSA-2026-12: [IRC] Stack buffer overflow when building a JOIN command with channel keys.
—
Fixed in version 4.9.5 ().
-
WSA-2026-11: [Logger] Write of logger file outside of configured path.
—
Fixed in version 4.9.4 ().
-
WSA-2026-7: [Xfer] Buffer overflow when receiving a line in a Xfer chat (DCC chat) buffer.
—
Fixed in version 4.9.2 ().
-
WSA-2026-6: [Xfer] Write of DCC file received outside of configured download path.
—
Fixed in version 4.9.2 ().
-
WSA-2026-4: [Relay] Missing size limit for the received websocket frame, HTTP message and HTTP body.
—
Fixed in version 4.9.2 ().
-
WSA-2026-3: [IRC] Missing size limit for the unterminated IRC message or isupport value (message 005).
—
Fixed in version 4.9.2 ().
-
WSA-2026-2: [API, Relay] Non-constant time password/hash comparison.
—
Fixed in version 4.9.1 ().
-
WSA-2025-6: [Core] Buffer overflow in base 32 encoding in evaluated expressions.
—
Fixed in version 4.6.3 ().
-
WSA-2025-3: [Core] Integer overflow in conversion of version to an integer number.
—
Fixed in version 4.6.3 ().
-
WSA-2025-2: [Core] Integer overflow in base32 decode/encode functions.
—
Fixed in version 4.6.3 ().
-
WSA-2025-1: [Core] Integer overflow with decimal numbers in calculation of expression.
—
Fixed in version 4.6.3 ().
-
WSA-2024-1: [Core, Plugins] Integer overflow in loops on lists.
—
Fixed in version 4.4.2 ().
-
WSA-2021-1: [Relay] Crash on malformed websocket frame in relay plugin.
—
Fixed in version 3.2.1 ().
Affected by 29 vulnerabilities:
-
WSA-2026-32: [Relay] Denial of service with many passwords in command init received from a relay client.
—
Fixed in version 4.10.4 ().
-
WSA-2026-31: [Relay] Bypass of TOTP and denial of service with invalid TOTP received from a relay client.
—
Fixed in version 4.10.4 ().
-
WSA-2026-30: [Xfer] Incoming files and chats auto-accepted from a nick on the wrong server.
—
Fixed in version 4.10.3 ().
-
WSA-2026-28: [Xfer] Missing checks of the resume position received in DCC RESUME and DCC ACCEPT.
—
Fixed in version 4.10.3 ().
-
WSA-2026-27: [Relay] Denial of service with huge IRC messages received from a relay client.
—
Fixed in version 4.10.3 ().
-
WSA-2026-25: [IRC] Evaluation of untrusted strings received from the IRC server or an IRC URL.
—
Fixed in version 4.10.2 ().
-
WSA-2026-24: [Relay] Missing size limit for HTTP headers received from a client.
—
Fixed in version 4.10.2 ().
-
WSA-2026-23: [Core] Heap buffer overflow in charset conversion.
—
Fixed in version 4.10.2 ().
-
WSA-2026-22: [Relay] Heap buffer overflow in path of hdata sent to clients with "weechat" protocol.
—
Fixed in version 4.10.2 ().
-
WSA-2026-21: [IRC] Heap buffer overflow in nick prefixes after a reconnection.
—
Fixed in version 4.10.2 ().
-
WSA-2026-20: [Relay] Missing size limit of data queued for sending to clients.
—
Fixed in version 4.10.1 ().
-
WSA-2026-19: [Relay] Missing rejection of invalid websocket frames.
—
Fixed in version 4.10.1 ().
-
WSA-2026-18: [Relay] Missing size limit for the unterminated Relay text message received from a client.
—
Fixed in version 4.10.1 ().
-
WSA-2026-17: [Xfer] Bypass of user authorization for start of DCC file transfer.
—
Fixed in version 4.10.1 ().
-
WSA-2026-16: [Xfer] Missing size limit for the unterminated Xfer chat message.
—
Fixed in version 4.10.1 ().
-
WSA-2026-15: [Xfer] Write of DCC file received outside of configured download path.
—
Fixed in version 4.10.1 ().
-
WSA-2026-12: [IRC] Stack buffer overflow when building a JOIN command with channel keys.
—
Fixed in version 4.9.5 ().
-
WSA-2026-11: [Logger] Write of logger file outside of configured path.
—
Fixed in version 4.9.4 ().
-
WSA-2026-7: [Xfer] Buffer overflow when receiving a line in a Xfer chat (DCC chat) buffer.
—
Fixed in version 4.9.2 ().
-
WSA-2026-6: [Xfer] Write of DCC file received outside of configured download path.
—
Fixed in version 4.9.2 ().
-
WSA-2026-4: [Relay] Missing size limit for the received websocket frame, HTTP message and HTTP body.
—
Fixed in version 4.9.2 ().
-
WSA-2026-3: [IRC] Missing size limit for the unterminated IRC message or isupport value (message 005).
—
Fixed in version 4.9.2 ().
-
WSA-2026-2: [API, Relay] Non-constant time password/hash comparison.
—
Fixed in version 4.9.1 ().
-
WSA-2025-6: [Core] Buffer overflow in base 32 encoding in evaluated expressions.
—
Fixed in version 4.6.3 ().
-
WSA-2025-3: [Core] Integer overflow in conversion of version to an integer number.
—
Fixed in version 4.6.3 ().
-
WSA-2025-2: [Core] Integer overflow in base32 decode/encode functions.
—
Fixed in version 4.6.3 ().
-
WSA-2025-1: [Core] Integer overflow with decimal numbers in calculation of expression.
—
Fixed in version 4.6.3 ().
-
WSA-2024-1: [Core, Plugins] Integer overflow in loops on lists.
—
Fixed in version 4.4.2 ().
-
WSA-2021-1: [Relay] Crash on malformed websocket frame in relay plugin.
—
Fixed in version 3.2.1 ().
Affected by 29 vulnerabilities:
-
WSA-2026-32: [Relay] Denial of service with many passwords in command init received from a relay client.
—
Fixed in version 4.10.4 ().
-
WSA-2026-31: [Relay] Bypass of TOTP and denial of service with invalid TOTP received from a relay client.
—
Fixed in version 4.10.4 ().
-
WSA-2026-30: [Xfer] Incoming files and chats auto-accepted from a nick on the wrong server.
—
Fixed in version 4.10.3 ().
-
WSA-2026-28: [Xfer] Missing checks of the resume position received in DCC RESUME and DCC ACCEPT.
—
Fixed in version 4.10.3 ().
-
WSA-2026-27: [Relay] Denial of service with huge IRC messages received from a relay client.
—
Fixed in version 4.10.3 ().
-
WSA-2026-25: [IRC] Evaluation of untrusted strings received from the IRC server or an IRC URL.
—
Fixed in version 4.10.2 ().
-
WSA-2026-24: [Relay] Missing size limit for HTTP headers received from a client.
—
Fixed in version 4.10.2 ().
-
WSA-2026-23: [Core] Heap buffer overflow in charset conversion.
—
Fixed in version 4.10.2 ().
-
WSA-2026-22: [Relay] Heap buffer overflow in path of hdata sent to clients with "weechat" protocol.
—
Fixed in version 4.10.2 ().
-
WSA-2026-21: [IRC] Heap buffer overflow in nick prefixes after a reconnection.
—
Fixed in version 4.10.2 ().
-
WSA-2026-20: [Relay] Missing size limit of data queued for sending to clients.
—
Fixed in version 4.10.1 ().
-
WSA-2026-19: [Relay] Missing rejection of invalid websocket frames.
—
Fixed in version 4.10.1 ().
-
WSA-2026-18: [Relay] Missing size limit for the unterminated Relay text message received from a client.
—
Fixed in version 4.10.1 ().
-
WSA-2026-17: [Xfer] Bypass of user authorization for start of DCC file transfer.
—
Fixed in version 4.10.1 ().
-
WSA-2026-16: [Xfer] Missing size limit for the unterminated Xfer chat message.
—
Fixed in version 4.10.1 ().
-
WSA-2026-15: [Xfer] Write of DCC file received outside of configured download path.
—
Fixed in version 4.10.1 ().
-
WSA-2026-12: [IRC] Stack buffer overflow when building a JOIN command with channel keys.
—
Fixed in version 4.9.5 ().
-
WSA-2026-11: [Logger] Write of logger file outside of configured path.
—
Fixed in version 4.9.4 ().
-
WSA-2026-7: [Xfer] Buffer overflow when receiving a line in a Xfer chat (DCC chat) buffer.
—
Fixed in version 4.9.2 ().
-
WSA-2026-6: [Xfer] Write of DCC file received outside of configured download path.
—
Fixed in version 4.9.2 ().
-
WSA-2026-4: [Relay] Missing size limit for the received websocket frame, HTTP message and HTTP body.
—
Fixed in version 4.9.2 ().
-
WSA-2026-3: [IRC] Missing size limit for the unterminated IRC message or isupport value (message 005).
—
Fixed in version 4.9.2 ().
-
WSA-2026-2: [API, Relay] Non-constant time password/hash comparison.
—
Fixed in version 4.9.1 ().
-
WSA-2025-6: [Core] Buffer overflow in base 32 encoding in evaluated expressions.
—
Fixed in version 4.6.3 ().
-
WSA-2025-3: [Core] Integer overflow in conversion of version to an integer number.
—
Fixed in version 4.6.3 ().
-
WSA-2025-2: [Core] Integer overflow in base32 decode/encode functions.
—
Fixed in version 4.6.3 ().
-
WSA-2025-1: [Core] Integer overflow with decimal numbers in calculation of expression.
—
Fixed in version 4.6.3 ().
-
WSA-2024-1: [Core, Plugins] Integer overflow in loops on lists.
—
Fixed in version 4.4.2 ().
-
WSA-2021-1: [Relay] Crash on malformed websocket frame in relay plugin.
—
Fixed in version 3.2.1 ().
Affected by 29 vulnerabilities:
-
WSA-2026-32: [Relay] Denial of service with many passwords in command init received from a relay client.
—
Fixed in version 4.10.4 ().
-
WSA-2026-31: [Relay] Bypass of TOTP and denial of service with invalid TOTP received from a relay client.
—
Fixed in version 4.10.4 ().
-
WSA-2026-30: [Xfer] Incoming files and chats auto-accepted from a nick on the wrong server.
—
Fixed in version 4.10.3 ().
-
WSA-2026-28: [Xfer] Missing checks of the resume position received in DCC RESUME and DCC ACCEPT.
—
Fixed in version 4.10.3 ().
-
WSA-2026-27: [Relay] Denial of service with huge IRC messages received from a relay client.
—
Fixed in version 4.10.3 ().
-
WSA-2026-25: [IRC] Evaluation of untrusted strings received from the IRC server or an IRC URL.
—
Fixed in version 4.10.2 ().
-
WSA-2026-24: [Relay] Missing size limit for HTTP headers received from a client.
—
Fixed in version 4.10.2 ().
-
WSA-2026-23: [Core] Heap buffer overflow in charset conversion.
—
Fixed in version 4.10.2 ().
-
WSA-2026-22: [Relay] Heap buffer overflow in path of hdata sent to clients with "weechat" protocol.
—
Fixed in version 4.10.2 ().
-
WSA-2026-21: [IRC] Heap buffer overflow in nick prefixes after a reconnection.
—
Fixed in version 4.10.2 ().
-
WSA-2026-20: [Relay] Missing size limit of data queued for sending to clients.
—
Fixed in version 4.10.1 ().
-
WSA-2026-19: [Relay] Missing rejection of invalid websocket frames.
—
Fixed in version 4.10.1 ().
-
WSA-2026-18: [Relay] Missing size limit for the unterminated Relay text message received from a client.
—
Fixed in version 4.10.1 ().
-
WSA-2026-17: [Xfer] Bypass of user authorization for start of DCC file transfer.
—
Fixed in version 4.10.1 ().
-
WSA-2026-16: [Xfer] Missing size limit for the unterminated Xfer chat message.
—
Fixed in version 4.10.1 ().
-
WSA-2026-15: [Xfer] Write of DCC file received outside of configured download path.
—
Fixed in version 4.10.1 ().
-
WSA-2026-12: [IRC] Stack buffer overflow when building a JOIN command with channel keys.
—
Fixed in version 4.9.5 ().
-
WSA-2026-11: [Logger] Write of logger file outside of configured path.
—
Fixed in version 4.9.4 ().
-
WSA-2026-7: [Xfer] Buffer overflow when receiving a line in a Xfer chat (DCC chat) buffer.
—
Fixed in version 4.9.2 ().
-
WSA-2026-6: [Xfer] Write of DCC file received outside of configured download path.
—
Fixed in version 4.9.2 ().
-
WSA-2026-4: [Relay] Missing size limit for the received websocket frame, HTTP message and HTTP body.
—
Fixed in version 4.9.2 ().
-
WSA-2026-3: [IRC] Missing size limit for the unterminated IRC message or isupport value (message 005).
—
Fixed in version 4.9.2 ().
-
WSA-2026-2: [API, Relay] Non-constant time password/hash comparison.
—
Fixed in version 4.9.1 ().
-
WSA-2025-6: [Core] Buffer overflow in base 32 encoding in evaluated expressions.
—
Fixed in version 4.6.3 ().
-
WSA-2025-3: [Core] Integer overflow in conversion of version to an integer number.
—
Fixed in version 4.6.3 ().
-
WSA-2025-2: [Core] Integer overflow in base32 decode/encode functions.
—
Fixed in version 4.6.3 ().
-
WSA-2025-1: [Core] Integer overflow with decimal numbers in calculation of expression.
—
Fixed in version 4.6.3 ().
-
WSA-2024-1: [Core, Plugins] Integer overflow in loops on lists.
—
Fixed in version 4.4.2 ().
-
WSA-2021-1: [Relay] Crash on malformed websocket frame in relay plugin.
—
Fixed in version 3.2.1 ().
Affected by 28 vulnerabilities:
-
WSA-2026-32: [Relay] Denial of service with many passwords in command init received from a relay client.
—
Fixed in version 4.10.4 ().
-
WSA-2026-31: [Relay] Bypass of TOTP and denial of service with invalid TOTP received from a relay client.
—
Fixed in version 4.10.4 ().
-
WSA-2026-30: [Xfer] Incoming files and chats auto-accepted from a nick on the wrong server.
—
Fixed in version 4.10.3 ().
-
WSA-2026-28: [Xfer] Missing checks of the resume position received in DCC RESUME and DCC ACCEPT.
—
Fixed in version 4.10.3 ().
-
WSA-2026-27: [Relay] Denial of service with huge IRC messages received from a relay client.
—
Fixed in version 4.10.3 ().
-
WSA-2026-25: [IRC] Evaluation of untrusted strings received from the IRC server or an IRC URL.
—
Fixed in version 4.10.2 ().
-
WSA-2026-24: [Relay] Missing size limit for HTTP headers received from a client.
—
Fixed in version 4.10.2 ().
-
WSA-2026-23: [Core] Heap buffer overflow in charset conversion.
—
Fixed in version 4.10.2 ().
-
WSA-2026-22: [Relay] Heap buffer overflow in path of hdata sent to clients with "weechat" protocol.
—
Fixed in version 4.10.2 ().
-
WSA-2026-21: [IRC] Heap buffer overflow in nick prefixes after a reconnection.
—
Fixed in version 4.10.2 ().
-
WSA-2026-20: [Relay] Missing size limit of data queued for sending to clients.
—
Fixed in version 4.10.1 ().
-
WSA-2026-19: [Relay] Missing rejection of invalid websocket frames.
—
Fixed in version 4.10.1 ().
-
WSA-2026-18: [Relay] Missing size limit for the unterminated Relay text message received from a client.
—
Fixed in version 4.10.1 ().
-
WSA-2026-17: [Xfer] Bypass of user authorization for start of DCC file transfer.
—
Fixed in version 4.10.1 ().
-
WSA-2026-16: [Xfer] Missing size limit for the unterminated Xfer chat message.
—
Fixed in version 4.10.1 ().
-
WSA-2026-15: [Xfer] Write of DCC file received outside of configured download path.
—
Fixed in version 4.10.1 ().
-
WSA-2026-12: [IRC] Stack buffer overflow when building a JOIN command with channel keys.
—
Fixed in version 4.9.5 ().
-
WSA-2026-11: [Logger] Write of logger file outside of configured path.
—
Fixed in version 4.9.4 ().
-
WSA-2026-7: [Xfer] Buffer overflow when receiving a line in a Xfer chat (DCC chat) buffer.
—
Fixed in version 4.9.2 ().
-
WSA-2026-6: [Xfer] Write of DCC file received outside of configured download path.
—
Fixed in version 4.9.2 ().
-
WSA-2026-4: [Relay] Missing size limit for the received websocket frame, HTTP message and HTTP body.
—
Fixed in version 4.9.2 ().
-
WSA-2026-3: [IRC] Missing size limit for the unterminated IRC message or isupport value (message 005).
—
Fixed in version 4.9.2 ().
-
WSA-2026-2: [API, Relay] Non-constant time password/hash comparison.
—
Fixed in version 4.9.1 ().
-
WSA-2025-3: [Core] Integer overflow in conversion of version to an integer number.
—
Fixed in version 4.6.3 ().
-
WSA-2025-2: [Core] Integer overflow in base32 decode/encode functions.
—
Fixed in version 4.6.3 ().
-
WSA-2025-1: [Core] Integer overflow with decimal numbers in calculation of expression.
—
Fixed in version 4.6.3 ().
-
WSA-2024-1: [Core, Plugins] Integer overflow in loops on lists.
—
Fixed in version 4.4.2 ().
-
WSA-2021-1: [Relay] Crash on malformed websocket frame in relay plugin.
—
Fixed in version 3.2.1 ().
Affected by 27 vulnerabilities:
-
WSA-2026-31: [Relay] Bypass of TOTP and denial of service with invalid TOTP received from a relay client.
—
Fixed in version 4.10.4 ().
-
WSA-2026-30: [Xfer] Incoming files and chats auto-accepted from a nick on the wrong server.
—
Fixed in version 4.10.3 ().
-
WSA-2026-28: [Xfer] Missing checks of the resume position received in DCC RESUME and DCC ACCEPT.
—
Fixed in version 4.10.3 ().
-
WSA-2026-27: [Relay] Denial of service with huge IRC messages received from a relay client.
—
Fixed in version 4.10.3 ().
-
WSA-2026-25: [IRC] Evaluation of untrusted strings received from the IRC server or an IRC URL.
—
Fixed in version 4.10.2 ().
-
WSA-2026-24: [Relay] Missing size limit for HTTP headers received from a client.
—
Fixed in version 4.10.2 ().
-
WSA-2026-23: [Core] Heap buffer overflow in charset conversion.
—
Fixed in version 4.10.2 ().
-
WSA-2026-22: [Relay] Heap buffer overflow in path of hdata sent to clients with "weechat" protocol.
—
Fixed in version 4.10.2 ().
-
WSA-2026-21: [IRC] Heap buffer overflow in nick prefixes after a reconnection.
—
Fixed in version 4.10.2 ().
-
WSA-2026-20: [Relay] Missing size limit of data queued for sending to clients.
—
Fixed in version 4.10.1 ().
-
WSA-2026-19: [Relay] Missing rejection of invalid websocket frames.
—
Fixed in version 4.10.1 ().
-
WSA-2026-18: [Relay] Missing size limit for the unterminated Relay text message received from a client.
—
Fixed in version 4.10.1 ().
-
WSA-2026-17: [Xfer] Bypass of user authorization for start of DCC file transfer.
—
Fixed in version 4.10.1 ().
-
WSA-2026-16: [Xfer] Missing size limit for the unterminated Xfer chat message.
—
Fixed in version 4.10.1 ().
-
WSA-2026-15: [Xfer] Write of DCC file received outside of configured download path.
—
Fixed in version 4.10.1 ().
-
WSA-2026-12: [IRC] Stack buffer overflow when building a JOIN command with channel keys.
—
Fixed in version 4.9.5 ().
-
WSA-2026-11: [Logger] Write of logger file outside of configured path.
—
Fixed in version 4.9.4 ().
-
WSA-2026-7: [Xfer] Buffer overflow when receiving a line in a Xfer chat (DCC chat) buffer.
—
Fixed in version 4.9.2 ().
-
WSA-2026-6: [Xfer] Write of DCC file received outside of configured download path.
—
Fixed in version 4.9.2 ().
-
WSA-2026-4: [Relay] Missing size limit for the received websocket frame, HTTP message and HTTP body.
—
Fixed in version 4.9.2 ().
-
WSA-2026-3: [IRC] Missing size limit for the unterminated IRC message or isupport value (message 005).
—
Fixed in version 4.9.2 ().
-
WSA-2026-2: [API, Relay] Non-constant time password/hash comparison.
—
Fixed in version 4.9.1 ().
-
WSA-2025-3: [Core] Integer overflow in conversion of version to an integer number.
—
Fixed in version 4.6.3 ().
-
WSA-2025-2: [Core] Integer overflow in base32 decode/encode functions.
—
Fixed in version 4.6.3 ().
-
WSA-2025-1: [Core] Integer overflow with decimal numbers in calculation of expression.
—
Fixed in version 4.6.3 ().
-
WSA-2024-1: [Core, Plugins] Integer overflow in loops on lists.
—
Fixed in version 4.4.2 ().
-
WSA-2021-1: [Relay] Crash on malformed websocket frame in relay plugin.
—
Fixed in version 3.2.1 ().
Affected by 29 vulnerabilities:
-
WSA-2026-31: [Relay] Bypass of TOTP and denial of service with invalid TOTP received from a relay client.
—
Fixed in version 4.10.4 ().
-
WSA-2026-30: [Xfer] Incoming files and chats auto-accepted from a nick on the wrong server.
—
Fixed in version 4.10.3 ().
-
WSA-2026-28: [Xfer] Missing checks of the resume position received in DCC RESUME and DCC ACCEPT.
—
Fixed in version 4.10.3 ().
-
WSA-2026-27: [Relay] Denial of service with huge IRC messages received from a relay client.
—
Fixed in version 4.10.3 ().
-
WSA-2026-25: [IRC] Evaluation of untrusted strings received from the IRC server or an IRC URL.
—
Fixed in version 4.10.2 ().
-
WSA-2026-24: [Relay] Missing size limit for HTTP headers received from a client.
—
Fixed in version 4.10.2 ().
-
WSA-2026-23: [Core] Heap buffer overflow in charset conversion.
—
Fixed in version 4.10.2 ().
-
WSA-2026-22: [Relay] Heap buffer overflow in path of hdata sent to clients with "weechat" protocol.
—
Fixed in version 4.10.2 ().
-
WSA-2026-20: [Relay] Missing size limit of data queued for sending to clients.
—
Fixed in version 4.10.1 ().
-
WSA-2026-19: [Relay] Missing rejection of invalid websocket frames.
—
Fixed in version 4.10.1 ().
-
WSA-2026-18: [Relay] Missing size limit for the unterminated Relay text message received from a client.
—
Fixed in version 4.10.1 ().
-
WSA-2026-17: [Xfer] Bypass of user authorization for start of DCC file transfer.
—
Fixed in version 4.10.1 ().
-
WSA-2026-16: [Xfer] Missing size limit for the unterminated Xfer chat message.
—
Fixed in version 4.10.1 ().
-
WSA-2026-15: [Xfer] Write of DCC file received outside of configured download path.
—
Fixed in version 4.10.1 ().
-
WSA-2026-12: [IRC] Stack buffer overflow when building a JOIN command with channel keys.
—
Fixed in version 4.9.5 ().
-
WSA-2026-11: [Logger] Write of logger file outside of configured path.
—
Fixed in version 4.9.4 ().
-
WSA-2026-7: [Xfer] Buffer overflow when receiving a line in a Xfer chat (DCC chat) buffer.
—
Fixed in version 4.9.2 ().
-
WSA-2026-6: [Xfer] Write of DCC file received outside of configured download path.
—
Fixed in version 4.9.2 ().
-
WSA-2026-4: [Relay] Missing size limit for the received websocket frame, HTTP message and HTTP body.
—
Fixed in version 4.9.2 ().
-
WSA-2026-3: [IRC] Missing size limit for the unterminated IRC message or isupport value (message 005).
—
Fixed in version 4.9.2 ().
-
WSA-2026-2: [API, Relay] Non-constant time password/hash comparison.
—
Fixed in version 4.9.1 ().
-
WSA-2025-3: [Core] Integer overflow in conversion of version to an integer number.
—
Fixed in version 4.6.3 ().
-
WSA-2025-2: [Core] Integer overflow in base32 decode/encode functions.
—
Fixed in version 4.6.3 ().
-
WSA-2025-1: [Core] Integer overflow with decimal numbers in calculation of expression.
—
Fixed in version 4.6.3 ().
-
WSA-2024-1: [Core, Plugins] Integer overflow in loops on lists.
—
Fixed in version 4.4.2 ().
-
WSA-2021-1: [Relay] Crash on malformed websocket frame in relay plugin.
—
Fixed in version 3.2.1 ().
-
WSA-2020-3: [IRC] Buffer overflow on new IRC message 005 with nick prefixes.
—
Fixed in version 2.7.1 ().
-
WSA-2020-2: [IRC] Crash on malformed IRC message 352 (WHO).
—
Fixed in version 2.7.1 ().
-
WSA-2020-1: [IRC] Buffer overflow on malformed IRC message 324 (channel mode).
—
Fixed in version 2.7.1 ().
Affected by 28 vulnerabilities:
-
WSA-2026-31: [Relay] Bypass of TOTP and denial of service with invalid TOTP received from a relay client.
—
Fixed in version 4.10.4 ().
-
WSA-2026-30: [Xfer] Incoming files and chats auto-accepted from a nick on the wrong server.
—
Fixed in version 4.10.3 ().
-
WSA-2026-28: [Xfer] Missing checks of the resume position received in DCC RESUME and DCC ACCEPT.
—
Fixed in version 4.10.3 ().
-
WSA-2026-27: [Relay] Denial of service with huge IRC messages received from a relay client.
—
Fixed in version 4.10.3 ().
-
WSA-2026-25: [IRC] Evaluation of untrusted strings received from the IRC server or an IRC URL.
—
Fixed in version 4.10.2 ().
-
WSA-2026-24: [Relay] Missing size limit for HTTP headers received from a client.
—
Fixed in version 4.10.2 ().
-
WSA-2026-23: [Core] Heap buffer overflow in charset conversion.
—
Fixed in version 4.10.2 ().
-
WSA-2026-22: [Relay] Heap buffer overflow in path of hdata sent to clients with "weechat" protocol.
—
Fixed in version 4.10.2 ().
-
WSA-2026-20: [Relay] Missing size limit of data queued for sending to clients.
—
Fixed in version 4.10.1 ().
-
WSA-2026-19: [Relay] Missing rejection of invalid websocket frames.
—
Fixed in version 4.10.1 ().
-
WSA-2026-18: [Relay] Missing size limit for the unterminated Relay text message received from a client.
—
Fixed in version 4.10.1 ().
-
WSA-2026-17: [Xfer] Bypass of user authorization for start of DCC file transfer.
—
Fixed in version 4.10.1 ().
-
WSA-2026-16: [Xfer] Missing size limit for the unterminated Xfer chat message.
—
Fixed in version 4.10.1 ().
-
WSA-2026-15: [Xfer] Write of DCC file received outside of configured download path.
—
Fixed in version 4.10.1 ().
-
WSA-2026-12: [IRC] Stack buffer overflow when building a JOIN command with channel keys.
—
Fixed in version 4.9.5 ().
-
WSA-2026-11: [Logger] Write of logger file outside of configured path.
—
Fixed in version 4.9.4 ().
-
WSA-2026-7: [Xfer] Buffer overflow when receiving a line in a Xfer chat (DCC chat) buffer.
—
Fixed in version 4.9.2 ().
-
WSA-2026-6: [Xfer] Write of DCC file received outside of configured download path.
—
Fixed in version 4.9.2 ().
-
WSA-2026-4: [Relay] Missing size limit for the received websocket frame, HTTP message and HTTP body.
—
Fixed in version 4.9.2 ().
-
WSA-2026-3: [IRC] Missing size limit for the unterminated IRC message or isupport value (message 005).
—
Fixed in version 4.9.2 ().
-
WSA-2026-2: [API, Relay] Non-constant time password/hash comparison.
—
Fixed in version 4.9.1 ().
-
WSA-2025-3: [Core] Integer overflow in conversion of version to an integer number.
—
Fixed in version 4.6.3 ().
-
WSA-2025-2: [Core] Integer overflow in base32 decode/encode functions.
—
Fixed in version 4.6.3 ().
-
WSA-2024-1: [Core, Plugins] Integer overflow in loops on lists.
—
Fixed in version 4.4.2 ().
-
WSA-2021-1: [Relay] Crash on malformed websocket frame in relay plugin.
—
Fixed in version 3.2.1 ().
-
WSA-2020-3: [IRC] Buffer overflow on new IRC message 005 with nick prefixes.
—
Fixed in version 2.7.1 ().
-
WSA-2020-2: [IRC] Crash on malformed IRC message 352 (WHO).
—
Fixed in version 2.7.1 ().
-
WSA-2020-1: [IRC] Buffer overflow on malformed IRC message 324 (channel mode).
—
Fixed in version 2.7.1 ().
Affected by 28 vulnerabilities:
-
WSA-2026-31: [Relay] Bypass of TOTP and denial of service with invalid TOTP received from a relay client.
—
Fixed in version 4.10.4 ().
-
WSA-2026-30: [Xfer] Incoming files and chats auto-accepted from a nick on the wrong server.
—
Fixed in version 4.10.3 ().
-
WSA-2026-28: [Xfer] Missing checks of the resume position received in DCC RESUME and DCC ACCEPT.
—
Fixed in version 4.10.3 ().
-
WSA-2026-27: [Relay] Denial of service with huge IRC messages received from a relay client.
—
Fixed in version 4.10.3 ().
-
WSA-2026-25: [IRC] Evaluation of untrusted strings received from the IRC server or an IRC URL.
—
Fixed in version 4.10.2 ().
-
WSA-2026-24: [Relay] Missing size limit for HTTP headers received from a client.
—
Fixed in version 4.10.2 ().
-
WSA-2026-23: [Core] Heap buffer overflow in charset conversion.
—
Fixed in version 4.10.2 ().
-
WSA-2026-22: [Relay] Heap buffer overflow in path of hdata sent to clients with "weechat" protocol.
—
Fixed in version 4.10.2 ().
-
WSA-2026-20: [Relay] Missing size limit of data queued for sending to clients.
—
Fixed in version 4.10.1 ().
-
WSA-2026-19: [Relay] Missing rejection of invalid websocket frames.
—
Fixed in version 4.10.1 ().
-
WSA-2026-18: [Relay] Missing size limit for the unterminated Relay text message received from a client.
—
Fixed in version 4.10.1 ().
-
WSA-2026-17: [Xfer] Bypass of user authorization for start of DCC file transfer.
—
Fixed in version 4.10.1 ().
-
WSA-2026-16: [Xfer] Missing size limit for the unterminated Xfer chat message.
—
Fixed in version 4.10.1 ().
-
WSA-2026-15: [Xfer] Write of DCC file received outside of configured download path.
—
Fixed in version 4.10.1 ().
-
WSA-2026-12: [IRC] Stack buffer overflow when building a JOIN command with channel keys.
—
Fixed in version 4.9.5 ().
-
WSA-2026-11: [Logger] Write of logger file outside of configured path.
—
Fixed in version 4.9.4 ().
-
WSA-2026-7: [Xfer] Buffer overflow when receiving a line in a Xfer chat (DCC chat) buffer.
—
Fixed in version 4.9.2 ().
-
WSA-2026-6: [Xfer] Write of DCC file received outside of configured download path.
—
Fixed in version 4.9.2 ().
-
WSA-2026-4: [Relay] Missing size limit for the received websocket frame, HTTP message and HTTP body.
—
Fixed in version 4.9.2 ().
-
WSA-2026-3: [IRC] Missing size limit for the unterminated IRC message or isupport value (message 005).
—
Fixed in version 4.9.2 ().
-
WSA-2026-2: [API, Relay] Non-constant time password/hash comparison.
—
Fixed in version 4.9.1 ().
-
WSA-2025-3: [Core] Integer overflow in conversion of version to an integer number.
—
Fixed in version 4.6.3 ().
-
WSA-2025-2: [Core] Integer overflow in base32 decode/encode functions.
—
Fixed in version 4.6.3 ().
-
WSA-2024-1: [Core, Plugins] Integer overflow in loops on lists.
—
Fixed in version 4.4.2 ().
-
WSA-2021-1: [Relay] Crash on malformed websocket frame in relay plugin.
—
Fixed in version 3.2.1 ().
-
WSA-2020-3: [IRC] Buffer overflow on new IRC message 005 with nick prefixes.
—
Fixed in version 2.7.1 ().
-
WSA-2020-2: [IRC] Crash on malformed IRC message 352 (WHO).
—
Fixed in version 2.7.1 ().
-
WSA-2020-1: [IRC] Buffer overflow on malformed IRC message 324 (channel mode).
—
Fixed in version 2.7.1 ().
Affected by 28 vulnerabilities:
-
WSA-2026-31: [Relay] Bypass of TOTP and denial of service with invalid TOTP received from a relay client.
—
Fixed in version 4.10.4 ().
-
WSA-2026-30: [Xfer] Incoming files and chats auto-accepted from a nick on the wrong server.
—
Fixed in version 4.10.3 ().
-
WSA-2026-28: [Xfer] Missing checks of the resume position received in DCC RESUME and DCC ACCEPT.
—
Fixed in version 4.10.3 ().
-
WSA-2026-27: [Relay] Denial of service with huge IRC messages received from a relay client.
—
Fixed in version 4.10.3 ().
-
WSA-2026-25: [IRC] Evaluation of untrusted strings received from the IRC server or an IRC URL.
—
Fixed in version 4.10.2 ().
-
WSA-2026-24: [Relay] Missing size limit for HTTP headers received from a client.
—
Fixed in version 4.10.2 ().
-
WSA-2026-23: [Core] Heap buffer overflow in charset conversion.
—
Fixed in version 4.10.2 ().
-
WSA-2026-22: [Relay] Heap buffer overflow in path of hdata sent to clients with "weechat" protocol.
—
Fixed in version 4.10.2 ().
-
WSA-2026-20: [Relay] Missing size limit of data queued for sending to clients.
—
Fixed in version 4.10.1 ().
-
WSA-2026-19: [Relay] Missing rejection of invalid websocket frames.
—
Fixed in version 4.10.1 ().
-
WSA-2026-18: [Relay] Missing size limit for the unterminated Relay text message received from a client.
—
Fixed in version 4.10.1 ().
-
WSA-2026-17: [Xfer] Bypass of user authorization for start of DCC file transfer.
—
Fixed in version 4.10.1 ().
-
WSA-2026-16: [Xfer] Missing size limit for the unterminated Xfer chat message.
—
Fixed in version 4.10.1 ().
-
WSA-2026-15: [Xfer] Write of DCC file received outside of configured download path.
—
Fixed in version 4.10.1 ().
-
WSA-2026-12: [IRC] Stack buffer overflow when building a JOIN command with channel keys.
—
Fixed in version 4.9.5 ().
-
WSA-2026-11: [Logger] Write of logger file outside of configured path.
—
Fixed in version 4.9.4 ().
-
WSA-2026-7: [Xfer] Buffer overflow when receiving a line in a Xfer chat (DCC chat) buffer.
—
Fixed in version 4.9.2 ().
-
WSA-2026-6: [Xfer] Write of DCC file received outside of configured download path.
—
Fixed in version 4.9.2 ().
-
WSA-2026-4: [Relay] Missing size limit for the received websocket frame, HTTP message and HTTP body.
—
Fixed in version 4.9.2 ().
-
WSA-2026-3: [IRC] Missing size limit for the unterminated IRC message or isupport value (message 005).
—
Fixed in version 4.9.2 ().
-
WSA-2026-2: [API, Relay] Non-constant time password/hash comparison.
—
Fixed in version 4.9.1 ().
-
WSA-2025-3: [Core] Integer overflow in conversion of version to an integer number.
—
Fixed in version 4.6.3 ().
-
WSA-2025-2: [Core] Integer overflow in base32 decode/encode functions.
—
Fixed in version 4.6.3 ().
-
WSA-2024-1: [Core, Plugins] Integer overflow in loops on lists.
—
Fixed in version 4.4.2 ().
-
WSA-2021-1: [Relay] Crash on malformed websocket frame in relay plugin.
—
Fixed in version 3.2.1 ().
-
WSA-2020-3: [IRC] Buffer overflow on new IRC message 005 with nick prefixes.
—
Fixed in version 2.7.1 ().
-
WSA-2020-2: [IRC] Crash on malformed IRC message 352 (WHO).
—
Fixed in version 2.7.1 ().
-
WSA-2020-1: [IRC] Buffer overflow on malformed IRC message 324 (channel mode).
—
Fixed in version 2.7.1 ().
Affected by 26 vulnerabilities:
-
WSA-2026-30: [Xfer] Incoming files and chats auto-accepted from a nick on the wrong server.
—
Fixed in version 4.10.3 ().
-
WSA-2026-28: [Xfer] Missing checks of the resume position received in DCC RESUME and DCC ACCEPT.
—
Fixed in version 4.10.3 ().
-
WSA-2026-27: [Relay] Denial of service with huge IRC messages received from a relay client.
—
Fixed in version 4.10.3 ().
-
WSA-2026-25: [IRC] Evaluation of untrusted strings received from the IRC server or an IRC URL.
—
Fixed in version 4.10.2 ().
-
WSA-2026-24: [Relay] Missing size limit for HTTP headers received from a client.
—
Fixed in version 4.10.2 ().
-
WSA-2026-23: [Core] Heap buffer overflow in charset conversion.
—
Fixed in version 4.10.2 ().
-
WSA-2026-22: [Relay] Heap buffer overflow in path of hdata sent to clients with "weechat" protocol.
—
Fixed in version 4.10.2 ().
-
WSA-2026-20: [Relay] Missing size limit of data queued for sending to clients.
—
Fixed in version 4.10.1 ().
-
WSA-2026-19: [Relay] Missing rejection of invalid websocket frames.
—
Fixed in version 4.10.1 ().
-
WSA-2026-18: [Relay] Missing size limit for the unterminated Relay text message received from a client.
—
Fixed in version 4.10.1 ().
-
WSA-2026-17: [Xfer] Bypass of user authorization for start of DCC file transfer.
—
Fixed in version 4.10.1 ().
-
WSA-2026-16: [Xfer] Missing size limit for the unterminated Xfer chat message.
—
Fixed in version 4.10.1 ().
-
WSA-2026-15: [Xfer] Write of DCC file received outside of configured download path.
—
Fixed in version 4.10.1 ().
-
WSA-2026-12: [IRC] Stack buffer overflow when building a JOIN command with channel keys.
—
Fixed in version 4.9.5 ().
-
WSA-2026-11: [Logger] Write of logger file outside of configured path.
—
Fixed in version 4.9.4 ().
-
WSA-2026-7: [Xfer] Buffer overflow when receiving a line in a Xfer chat (DCC chat) buffer.
—
Fixed in version 4.9.2 ().
-
WSA-2026-6: [Xfer] Write of DCC file received outside of configured download path.
—
Fixed in version 4.9.2 ().
-
WSA-2026-4: [Relay] Missing size limit for the received websocket frame, HTTP message and HTTP body.
—
Fixed in version 4.9.2 ().
-
WSA-2026-3: [IRC] Missing size limit for the unterminated IRC message or isupport value (message 005).
—
Fixed in version 4.9.2 ().
-
WSA-2026-2: [API, Relay] Non-constant time password/hash comparison.
—
Fixed in version 4.9.1 ().
-
WSA-2025-3: [Core] Integer overflow in conversion of version to an integer number.
—
Fixed in version 4.6.3 ().
-
WSA-2024-1: [Core, Plugins] Integer overflow in loops on lists.
—
Fixed in version 4.4.2 ().
-
WSA-2021-1: [Relay] Crash on malformed websocket frame in relay plugin.
—
Fixed in version 3.2.1 ().
-
WSA-2020-3: [IRC] Buffer overflow on new IRC message 005 with nick prefixes.
—
Fixed in version 2.7.1 ().
-
WSA-2020-2: [IRC] Crash on malformed IRC message 352 (WHO).
—
Fixed in version 2.7.1 ().
-
WSA-2020-1: [IRC] Buffer overflow on malformed IRC message 324 (channel mode).
—
Fixed in version 2.7.1 ().
Affected by 26 vulnerabilities:
-
WSA-2026-30: [Xfer] Incoming files and chats auto-accepted from a nick on the wrong server.
—
Fixed in version 4.10.3 ().
-
WSA-2026-28: [Xfer] Missing checks of the resume position received in DCC RESUME and DCC ACCEPT.
—
Fixed in version 4.10.3 ().
-
WSA-2026-27: [Relay] Denial of service with huge IRC messages received from a relay client.
—
Fixed in version 4.10.3 ().
-
WSA-2026-25: [IRC] Evaluation of untrusted strings received from the IRC server or an IRC URL.
—
Fixed in version 4.10.2 ().
-
WSA-2026-24: [Relay] Missing size limit for HTTP headers received from a client.
—
Fixed in version 4.10.2 ().
-
WSA-2026-23: [Core] Heap buffer overflow in charset conversion.
—
Fixed in version 4.10.2 ().
-
WSA-2026-22: [Relay] Heap buffer overflow in path of hdata sent to clients with "weechat" protocol.
—
Fixed in version 4.10.2 ().
-
WSA-2026-20: [Relay] Missing size limit of data queued for sending to clients.
—
Fixed in version 4.10.1 ().
-
WSA-2026-19: [Relay] Missing rejection of invalid websocket frames.
—
Fixed in version 4.10.1 ().
-
WSA-2026-18: [Relay] Missing size limit for the unterminated Relay text message received from a client.
—
Fixed in version 4.10.1 ().
-
WSA-2026-17: [Xfer] Bypass of user authorization for start of DCC file transfer.
—
Fixed in version 4.10.1 ().
-
WSA-2026-16: [Xfer] Missing size limit for the unterminated Xfer chat message.
—
Fixed in version 4.10.1 ().
-
WSA-2026-15: [Xfer] Write of DCC file received outside of configured download path.
—
Fixed in version 4.10.1 ().
-
WSA-2026-12: [IRC] Stack buffer overflow when building a JOIN command with channel keys.
—
Fixed in version 4.9.5 ().
-
WSA-2026-11: [Logger] Write of logger file outside of configured path.
—
Fixed in version 4.9.4 ().
-
WSA-2026-7: [Xfer] Buffer overflow when receiving a line in a Xfer chat (DCC chat) buffer.
—
Fixed in version 4.9.2 ().
-
WSA-2026-6: [Xfer] Write of DCC file received outside of configured download path.
—
Fixed in version 4.9.2 ().
-
WSA-2026-4: [Relay] Missing size limit for the received websocket frame, HTTP message and HTTP body.
—
Fixed in version 4.9.2 ().
-
WSA-2026-3: [IRC] Missing size limit for the unterminated IRC message or isupport value (message 005).
—
Fixed in version 4.9.2 ().
-
WSA-2026-2: [API, Relay] Non-constant time password/hash comparison.
—
Fixed in version 4.9.1 ().
-
WSA-2025-3: [Core] Integer overflow in conversion of version to an integer number.
—
Fixed in version 4.6.3 ().
-
WSA-2024-1: [Core, Plugins] Integer overflow in loops on lists.
—
Fixed in version 4.4.2 ().
-
WSA-2021-1: [Relay] Crash on malformed websocket frame in relay plugin.
—
Fixed in version 3.2.1 ().
-
WSA-2020-3: [IRC] Buffer overflow on new IRC message 005 with nick prefixes.
—
Fixed in version 2.7.1 ().
-
WSA-2020-2: [IRC] Crash on malformed IRC message 352 (WHO).
—
Fixed in version 2.7.1 ().
-
WSA-2020-1: [IRC] Buffer overflow on malformed IRC message 324 (channel mode).
—
Fixed in version 2.7.1 ().
Affected by 26 vulnerabilities:
-
WSA-2026-30: [Xfer] Incoming files and chats auto-accepted from a nick on the wrong server.
—
Fixed in version 4.10.3 ().
-
WSA-2026-28: [Xfer] Missing checks of the resume position received in DCC RESUME and DCC ACCEPT.
—
Fixed in version 4.10.3 ().
-
WSA-2026-27: [Relay] Denial of service with huge IRC messages received from a relay client.
—
Fixed in version 4.10.3 ().
-
WSA-2026-25: [IRC] Evaluation of untrusted strings received from the IRC server or an IRC URL.
—
Fixed in version 4.10.2 ().
-
WSA-2026-24: [Relay] Missing size limit for HTTP headers received from a client.
—
Fixed in version 4.10.2 ().
-
WSA-2026-23: [Core] Heap buffer overflow in charset conversion.
—
Fixed in version 4.10.2 ().
-
WSA-2026-22: [Relay] Heap buffer overflow in path of hdata sent to clients with "weechat" protocol.
—
Fixed in version 4.10.2 ().
-
WSA-2026-20: [Relay] Missing size limit of data queued for sending to clients.
—
Fixed in version 4.10.1 ().
-
WSA-2026-19: [Relay] Missing rejection of invalid websocket frames.
—
Fixed in version 4.10.1 ().
-
WSA-2026-18: [Relay] Missing size limit for the unterminated Relay text message received from a client.
—
Fixed in version 4.10.1 ().
-
WSA-2026-17: [Xfer] Bypass of user authorization for start of DCC file transfer.
—
Fixed in version 4.10.1 ().
-
WSA-2026-16: [Xfer] Missing size limit for the unterminated Xfer chat message.
—
Fixed in version 4.10.1 ().
-
WSA-2026-15: [Xfer] Write of DCC file received outside of configured download path.
—
Fixed in version 4.10.1 ().
-
WSA-2026-12: [IRC] Stack buffer overflow when building a JOIN command with channel keys.
—
Fixed in version 4.9.5 ().
-
WSA-2026-11: [Logger] Write of logger file outside of configured path.
—
Fixed in version 4.9.4 ().
-
WSA-2026-7: [Xfer] Buffer overflow when receiving a line in a Xfer chat (DCC chat) buffer.
—
Fixed in version 4.9.2 ().
-
WSA-2026-6: [Xfer] Write of DCC file received outside of configured download path.
—
Fixed in version 4.9.2 ().
-
WSA-2026-4: [Relay] Missing size limit for the received websocket frame, HTTP message and HTTP body.
—
Fixed in version 4.9.2 ().
-
WSA-2026-3: [IRC] Missing size limit for the unterminated IRC message or isupport value (message 005).
—
Fixed in version 4.9.2 ().
-
WSA-2026-2: [API, Relay] Non-constant time password/hash comparison.
—
Fixed in version 4.9.1 ().
-
WSA-2025-3: [Core] Integer overflow in conversion of version to an integer number.
—
Fixed in version 4.6.3 ().
-
WSA-2024-1: [Core, Plugins] Integer overflow in loops on lists.
—
Fixed in version 4.4.2 ().
-
WSA-2021-1: [Relay] Crash on malformed websocket frame in relay plugin.
—
Fixed in version 3.2.1 ().
-
WSA-2020-3: [IRC] Buffer overflow on new IRC message 005 with nick prefixes.
—
Fixed in version 2.7.1 ().
-
WSA-2020-2: [IRC] Crash on malformed IRC message 352 (WHO).
—
Fixed in version 2.7.1 ().
-
WSA-2020-1: [IRC] Buffer overflow on malformed IRC message 324 (channel mode).
—
Fixed in version 2.7.1 ().
Affected by 26 vulnerabilities:
-
WSA-2026-30: [Xfer] Incoming files and chats auto-accepted from a nick on the wrong server.
—
Fixed in version 4.10.3 ().
-
WSA-2026-28: [Xfer] Missing checks of the resume position received in DCC RESUME and DCC ACCEPT.
—
Fixed in version 4.10.3 ().
-
WSA-2026-27: [Relay] Denial of service with huge IRC messages received from a relay client.
—
Fixed in version 4.10.3 ().
-
WSA-2026-25: [IRC] Evaluation of untrusted strings received from the IRC server or an IRC URL.
—
Fixed in version 4.10.2 ().
-
WSA-2026-24: [Relay] Missing size limit for HTTP headers received from a client.
—
Fixed in version 4.10.2 ().
-
WSA-2026-23: [Core] Heap buffer overflow in charset conversion.
—
Fixed in version 4.10.2 ().
-
WSA-2026-22: [Relay] Heap buffer overflow in path of hdata sent to clients with "weechat" protocol.
—
Fixed in version 4.10.2 ().
-
WSA-2026-20: [Relay] Missing size limit of data queued for sending to clients.
—
Fixed in version 4.10.1 ().
-
WSA-2026-19: [Relay] Missing rejection of invalid websocket frames.
—
Fixed in version 4.10.1 ().
-
WSA-2026-18: [Relay] Missing size limit for the unterminated Relay text message received from a client.
—
Fixed in version 4.10.1 ().
-
WSA-2026-17: [Xfer] Bypass of user authorization for start of DCC file transfer.
—
Fixed in version 4.10.1 ().
-
WSA-2026-16: [Xfer] Missing size limit for the unterminated Xfer chat message.
—
Fixed in version 4.10.1 ().
-
WSA-2026-15: [Xfer] Write of DCC file received outside of configured download path.
—
Fixed in version 4.10.1 ().
-
WSA-2026-12: [IRC] Stack buffer overflow when building a JOIN command with channel keys.
—
Fixed in version 4.9.5 ().
-
WSA-2026-11: [Logger] Write of logger file outside of configured path.
—
Fixed in version 4.9.4 ().
-
WSA-2026-7: [Xfer] Buffer overflow when receiving a line in a Xfer chat (DCC chat) buffer.
—
Fixed in version 4.9.2 ().
-
WSA-2026-6: [Xfer] Write of DCC file received outside of configured download path.
—
Fixed in version 4.9.2 ().
-
WSA-2026-4: [Relay] Missing size limit for the received websocket frame, HTTP message and HTTP body.
—
Fixed in version 4.9.2 ().
-
WSA-2026-3: [IRC] Missing size limit for the unterminated IRC message or isupport value (message 005).
—
Fixed in version 4.9.2 ().
-
WSA-2026-2: [API, Relay] Non-constant time password/hash comparison.
—
Fixed in version 4.9.1 ().
-
WSA-2025-3: [Core] Integer overflow in conversion of version to an integer number.
—
Fixed in version 4.6.3 ().
-
WSA-2024-1: [Core, Plugins] Integer overflow in loops on lists.
—
Fixed in version 4.4.2 ().
-
WSA-2021-1: [Relay] Crash on malformed websocket frame in relay plugin.
—
Fixed in version 3.2.1 ().
-
WSA-2020-3: [IRC] Buffer overflow on new IRC message 005 with nick prefixes.
—
Fixed in version 2.7.1 ().
-
WSA-2020-2: [IRC] Crash on malformed IRC message 352 (WHO).
—
Fixed in version 2.7.1 ().
-
WSA-2020-1: [IRC] Buffer overflow on malformed IRC message 324 (channel mode).
—
Fixed in version 2.7.1 ().
Affected by 26 vulnerabilities:
-
WSA-2026-30: [Xfer] Incoming files and chats auto-accepted from a nick on the wrong server.
—
Fixed in version 4.10.3 ().
-
WSA-2026-28: [Xfer] Missing checks of the resume position received in DCC RESUME and DCC ACCEPT.
—
Fixed in version 4.10.3 ().
-
WSA-2026-27: [Relay] Denial of service with huge IRC messages received from a relay client.
—
Fixed in version 4.10.3 ().
-
WSA-2026-25: [IRC] Evaluation of untrusted strings received from the IRC server or an IRC URL.
—
Fixed in version 4.10.2 ().
-
WSA-2026-24: [Relay] Missing size limit for HTTP headers received from a client.
—
Fixed in version 4.10.2 ().
-
WSA-2026-23: [Core] Heap buffer overflow in charset conversion.
—
Fixed in version 4.10.2 ().
-
WSA-2026-22: [Relay] Heap buffer overflow in path of hdata sent to clients with "weechat" protocol.
—
Fixed in version 4.10.2 ().
-
WSA-2026-20: [Relay] Missing size limit of data queued for sending to clients.
—
Fixed in version 4.10.1 ().
-
WSA-2026-19: [Relay] Missing rejection of invalid websocket frames.
—
Fixed in version 4.10.1 ().
-
WSA-2026-18: [Relay] Missing size limit for the unterminated Relay text message received from a client.
—
Fixed in version 4.10.1 ().
-
WSA-2026-17: [Xfer] Bypass of user authorization for start of DCC file transfer.
—
Fixed in version 4.10.1 ().
-
WSA-2026-16: [Xfer] Missing size limit for the unterminated Xfer chat message.
—
Fixed in version 4.10.1 ().
-
WSA-2026-15: [Xfer] Write of DCC file received outside of configured download path.
—
Fixed in version 4.10.1 ().
-
WSA-2026-12: [IRC] Stack buffer overflow when building a JOIN command with channel keys.
—
Fixed in version 4.9.5 ().
-
WSA-2026-11: [Logger] Write of logger file outside of configured path.
—
Fixed in version 4.9.4 ().
-
WSA-2026-7: [Xfer] Buffer overflow when receiving a line in a Xfer chat (DCC chat) buffer.
—
Fixed in version 4.9.2 ().
-
WSA-2026-6: [Xfer] Write of DCC file received outside of configured download path.
—
Fixed in version 4.9.2 ().
-
WSA-2026-4: [Relay] Missing size limit for the received websocket frame, HTTP message and HTTP body.
—
Fixed in version 4.9.2 ().
-
WSA-2026-3: [IRC] Missing size limit for the unterminated IRC message or isupport value (message 005).
—
Fixed in version 4.9.2 ().
-
WSA-2026-2: [API, Relay] Non-constant time password/hash comparison.
—
Fixed in version 4.9.1 ().
-
WSA-2025-3: [Core] Integer overflow in conversion of version to an integer number.
—
Fixed in version 4.6.3 ().
-
WSA-2024-1: [Core, Plugins] Integer overflow in loops on lists.
—
Fixed in version 4.4.2 ().
-
WSA-2021-1: [Relay] Crash on malformed websocket frame in relay plugin.
—
Fixed in version 3.2.1 ().
-
WSA-2020-3: [IRC] Buffer overflow on new IRC message 005 with nick prefixes.
—
Fixed in version 2.7.1 ().
-
WSA-2020-2: [IRC] Crash on malformed IRC message 352 (WHO).
—
Fixed in version 2.7.1 ().
-
WSA-2020-1: [IRC] Buffer overflow on malformed IRC message 324 (channel mode).
—
Fixed in version 2.7.1 ().
Affected by 26 vulnerabilities:
-
WSA-2026-30: [Xfer] Incoming files and chats auto-accepted from a nick on the wrong server.
—
Fixed in version 4.10.3 ().
-
WSA-2026-28: [Xfer] Missing checks of the resume position received in DCC RESUME and DCC ACCEPT.
—
Fixed in version 4.10.3 ().
-
WSA-2026-27: [Relay] Denial of service with huge IRC messages received from a relay client.
—
Fixed in version 4.10.3 ().
-
WSA-2026-25: [IRC] Evaluation of untrusted strings received from the IRC server or an IRC URL.
—
Fixed in version 4.10.2 ().
-
WSA-2026-24: [Relay] Missing size limit for HTTP headers received from a client.
—
Fixed in version 4.10.2 ().
-
WSA-2026-23: [Core] Heap buffer overflow in charset conversion.
—
Fixed in version 4.10.2 ().
-
WSA-2026-22: [Relay] Heap buffer overflow in path of hdata sent to clients with "weechat" protocol.
—
Fixed in version 4.10.2 ().
-
WSA-2026-20: [Relay] Missing size limit of data queued for sending to clients.
—
Fixed in version 4.10.1 ().
-
WSA-2026-19: [Relay] Missing rejection of invalid websocket frames.
—
Fixed in version 4.10.1 ().
-
WSA-2026-18: [Relay] Missing size limit for the unterminated Relay text message received from a client.
—
Fixed in version 4.10.1 ().
-
WSA-2026-17: [Xfer] Bypass of user authorization for start of DCC file transfer.
—
Fixed in version 4.10.1 ().
-
WSA-2026-16: [Xfer] Missing size limit for the unterminated Xfer chat message.
—
Fixed in version 4.10.1 ().
-
WSA-2026-15: [Xfer] Write of DCC file received outside of configured download path.
—
Fixed in version 4.10.1 ().
-
WSA-2026-12: [IRC] Stack buffer overflow when building a JOIN command with channel keys.
—
Fixed in version 4.9.5 ().
-
WSA-2026-11: [Logger] Write of logger file outside of configured path.
—
Fixed in version 4.9.4 ().
-
WSA-2026-7: [Xfer] Buffer overflow when receiving a line in a Xfer chat (DCC chat) buffer.
—
Fixed in version 4.9.2 ().
-
WSA-2026-6: [Xfer] Write of DCC file received outside of configured download path.
—
Fixed in version 4.9.2 ().
-
WSA-2026-4: [Relay] Missing size limit for the received websocket frame, HTTP message and HTTP body.
—
Fixed in version 4.9.2 ().
-
WSA-2026-3: [IRC] Missing size limit for the unterminated IRC message or isupport value (message 005).
—
Fixed in version 4.9.2 ().
-
WSA-2026-2: [API, Relay] Non-constant time password/hash comparison.
—
Fixed in version 4.9.1 ().
-
WSA-2025-3: [Core] Integer overflow in conversion of version to an integer number.
—
Fixed in version 4.6.3 ().
-
WSA-2024-1: [Core, Plugins] Integer overflow in loops on lists.
—
Fixed in version 4.4.2 ().
-
WSA-2021-1: [Relay] Crash on malformed websocket frame in relay plugin.
—
Fixed in version 3.2.1 ().
-
WSA-2020-3: [IRC] Buffer overflow on new IRC message 005 with nick prefixes.
—
Fixed in version 2.7.1 ().
-
WSA-2020-2: [IRC] Crash on malformed IRC message 352 (WHO).
—
Fixed in version 2.7.1 ().
-
WSA-2020-1: [IRC] Buffer overflow on malformed IRC message 324 (channel mode).
—
Fixed in version 2.7.1 ().
Affected by 27 vulnerabilities:
-
WSA-2026-30: [Xfer] Incoming files and chats auto-accepted from a nick on the wrong server.
—
Fixed in version 4.10.3 ().
-
WSA-2026-28: [Xfer] Missing checks of the resume position received in DCC RESUME and DCC ACCEPT.
—
Fixed in version 4.10.3 ().
-
WSA-2026-27: [Relay] Denial of service with huge IRC messages received from a relay client.
—
Fixed in version 4.10.3 ().
-
WSA-2026-25: [IRC] Evaluation of untrusted strings received from the IRC server or an IRC URL.
—
Fixed in version 4.10.2 ().
-
WSA-2026-24: [Relay] Missing size limit for HTTP headers received from a client.
—
Fixed in version 4.10.2 ().
-
WSA-2026-23: [Core] Heap buffer overflow in charset conversion.
—
Fixed in version 4.10.2 ().
-
WSA-2026-22: [Relay] Heap buffer overflow in path of hdata sent to clients with "weechat" protocol.
—
Fixed in version 4.10.2 ().
-
WSA-2026-20: [Relay] Missing size limit of data queued for sending to clients.
—
Fixed in version 4.10.1 ().
-
WSA-2026-19: [Relay] Missing rejection of invalid websocket frames.
—
Fixed in version 4.10.1 ().
-
WSA-2026-18: [Relay] Missing size limit for the unterminated Relay text message received from a client.
—
Fixed in version 4.10.1 ().
-
WSA-2026-17: [Xfer] Bypass of user authorization for start of DCC file transfer.
—
Fixed in version 4.10.1 ().
-
WSA-2026-16: [Xfer] Missing size limit for the unterminated Xfer chat message.
—
Fixed in version 4.10.1 ().
-
WSA-2026-15: [Xfer] Write of DCC file received outside of configured download path.
—
Fixed in version 4.10.1 ().
-
WSA-2026-12: [IRC] Stack buffer overflow when building a JOIN command with channel keys.
—
Fixed in version 4.9.5 ().
-
WSA-2026-11: [Logger] Write of logger file outside of configured path.
—
Fixed in version 4.9.4 ().
-
WSA-2026-7: [Xfer] Buffer overflow when receiving a line in a Xfer chat (DCC chat) buffer.
—
Fixed in version 4.9.2 ().
-
WSA-2026-6: [Xfer] Write of DCC file received outside of configured download path.
—
Fixed in version 4.9.2 ().
-
WSA-2026-4: [Relay] Missing size limit for the received websocket frame, HTTP message and HTTP body.
—
Fixed in version 4.9.2 ().
-
WSA-2026-3: [IRC] Missing size limit for the unterminated IRC message or isupport value (message 005).
—
Fixed in version 4.9.2 ().
-
WSA-2026-2: [API, Relay] Non-constant time password/hash comparison.
—
Fixed in version 4.9.1 ().
-
WSA-2025-3: [Core] Integer overflow in conversion of version to an integer number.
—
Fixed in version 4.6.3 ().
-
WSA-2024-1: [Core, Plugins] Integer overflow in loops on lists.
—
Fixed in version 4.4.2 ().
-
WSA-2021-1: [Relay] Crash on malformed websocket frame in relay plugin.
—
Fixed in version 3.2.1 ().
-
WSA-2020-3: [IRC] Buffer overflow on new IRC message 005 with nick prefixes.
—
Fixed in version 2.7.1 ().
-
WSA-2020-2: [IRC] Crash on malformed IRC message 352 (WHO).
—
Fixed in version 2.7.1 ().
-
WSA-2020-1: [IRC] Buffer overflow on malformed IRC message 324 (channel mode).
—
Fixed in version 2.7.1 ().
-
WSA-2017-2: [Logger] Use of invalid pointer in build of log filename.
—
Fixed in version 1.9.1 ().
Affected by 27 vulnerabilities:
-
WSA-2026-30: [Xfer] Incoming files and chats auto-accepted from a nick on the wrong server.
—
Fixed in version 4.10.3 ().
-
WSA-2026-28: [Xfer] Missing checks of the resume position received in DCC RESUME and DCC ACCEPT.
—
Fixed in version 4.10.3 ().
-
WSA-2026-27: [Relay] Denial of service with huge IRC messages received from a relay client.
—
Fixed in version 4.10.3 ().
-
WSA-2026-25: [IRC] Evaluation of untrusted strings received from the IRC server or an IRC URL.
—
Fixed in version 4.10.2 ().
-
WSA-2026-24: [Relay] Missing size limit for HTTP headers received from a client.
—
Fixed in version 4.10.2 ().
-
WSA-2026-23: [Core] Heap buffer overflow in charset conversion.
—
Fixed in version 4.10.2 ().
-
WSA-2026-22: [Relay] Heap buffer overflow in path of hdata sent to clients with "weechat" protocol.
—
Fixed in version 4.10.2 ().
-
WSA-2026-20: [Relay] Missing size limit of data queued for sending to clients.
—
Fixed in version 4.10.1 ().
-
WSA-2026-19: [Relay] Missing rejection of invalid websocket frames.
—
Fixed in version 4.10.1 ().
-
WSA-2026-18: [Relay] Missing size limit for the unterminated Relay text message received from a client.
—
Fixed in version 4.10.1 ().
-
WSA-2026-17: [Xfer] Bypass of user authorization for start of DCC file transfer.
—
Fixed in version 4.10.1 ().
-
WSA-2026-16: [Xfer] Missing size limit for the unterminated Xfer chat message.
—
Fixed in version 4.10.1 ().
-
WSA-2026-15: [Xfer] Write of DCC file received outside of configured download path.
—
Fixed in version 4.10.1 ().
-
WSA-2026-12: [IRC] Stack buffer overflow when building a JOIN command with channel keys.
—
Fixed in version 4.9.5 ().
-
WSA-2026-11: [Logger] Write of logger file outside of configured path.
—
Fixed in version 4.9.4 ().
-
WSA-2026-7: [Xfer] Buffer overflow when receiving a line in a Xfer chat (DCC chat) buffer.
—
Fixed in version 4.9.2 ().
-
WSA-2026-6: [Xfer] Write of DCC file received outside of configured download path.
—
Fixed in version 4.9.2 ().
-
WSA-2026-4: [Relay] Missing size limit for the received websocket frame, HTTP message and HTTP body.
—
Fixed in version 4.9.2 ().
-
WSA-2026-3: [IRC] Missing size limit for the unterminated IRC message or isupport value (message 005).
—
Fixed in version 4.9.2 ().
-
WSA-2026-2: [API, Relay] Non-constant time password/hash comparison.
—
Fixed in version 4.9.1 ().
-
WSA-2025-3: [Core] Integer overflow in conversion of version to an integer number.
—
Fixed in version 4.6.3 ().
-
WSA-2024-1: [Core, Plugins] Integer overflow in loops on lists.
—
Fixed in version 4.4.2 ().
-
WSA-2021-1: [Relay] Crash on malformed websocket frame in relay plugin.
—
Fixed in version 3.2.1 ().
-
WSA-2020-3: [IRC] Buffer overflow on new IRC message 005 with nick prefixes.
—
Fixed in version 2.7.1 ().
-
WSA-2020-2: [IRC] Crash on malformed IRC message 352 (WHO).
—
Fixed in version 2.7.1 ().
-
WSA-2020-1: [IRC] Buffer overflow on malformed IRC message 324 (channel mode).
—
Fixed in version 2.7.1 ().
-
WSA-2017-2: [Logger] Use of invalid pointer in build of log filename.
—
Fixed in version 1.9.1 ().
Affected by 27 vulnerabilities:
-
WSA-2026-30: [Xfer] Incoming files and chats auto-accepted from a nick on the wrong server.
—
Fixed in version 4.10.3 ().
-
WSA-2026-28: [Xfer] Missing checks of the resume position received in DCC RESUME and DCC ACCEPT.
—
Fixed in version 4.10.3 ().
-
WSA-2026-27: [Relay] Denial of service with huge IRC messages received from a relay client.
—
Fixed in version 4.10.3 ().
-
WSA-2026-25: [IRC] Evaluation of untrusted strings received from the IRC server or an IRC URL.
—
Fixed in version 4.10.2 ().
-
WSA-2026-24: [Relay] Missing size limit for HTTP headers received from a client.
—
Fixed in version 4.10.2 ().
-
WSA-2026-23: [Core] Heap buffer overflow in charset conversion.
—
Fixed in version 4.10.2 ().
-
WSA-2026-22: [Relay] Heap buffer overflow in path of hdata sent to clients with "weechat" protocol.
—
Fixed in version 4.10.2 ().
-
WSA-2026-20: [Relay] Missing size limit of data queued for sending to clients.
—
Fixed in version 4.10.1 ().
-
WSA-2026-19: [Relay] Missing rejection of invalid websocket frames.
—
Fixed in version 4.10.1 ().
-
WSA-2026-18: [Relay] Missing size limit for the unterminated Relay text message received from a client.
—
Fixed in version 4.10.1 ().
-
WSA-2026-17: [Xfer] Bypass of user authorization for start of DCC file transfer.
—
Fixed in version 4.10.1 ().
-
WSA-2026-16: [Xfer] Missing size limit for the unterminated Xfer chat message.
—
Fixed in version 4.10.1 ().
-
WSA-2026-15: [Xfer] Write of DCC file received outside of configured download path.
—
Fixed in version 4.10.1 ().
-
WSA-2026-12: [IRC] Stack buffer overflow when building a JOIN command with channel keys.
—
Fixed in version 4.9.5 ().
-
WSA-2026-11: [Logger] Write of logger file outside of configured path.
—
Fixed in version 4.9.4 ().
-
WSA-2026-7: [Xfer] Buffer overflow when receiving a line in a Xfer chat (DCC chat) buffer.
—
Fixed in version 4.9.2 ().
-
WSA-2026-6: [Xfer] Write of DCC file received outside of configured download path.
—
Fixed in version 4.9.2 ().
-
WSA-2026-4: [Relay] Missing size limit for the received websocket frame, HTTP message and HTTP body.
—
Fixed in version 4.9.2 ().
-
WSA-2026-3: [IRC] Missing size limit for the unterminated IRC message or isupport value (message 005).
—
Fixed in version 4.9.2 ().
-
WSA-2026-2: [API, Relay] Non-constant time password/hash comparison.
—
Fixed in version 4.9.1 ().
-
WSA-2025-3: [Core] Integer overflow in conversion of version to an integer number.
—
Fixed in version 4.6.3 ().
-
WSA-2024-1: [Core, Plugins] Integer overflow in loops on lists.
—
Fixed in version 4.4.2 ().
-
WSA-2021-1: [Relay] Crash on malformed websocket frame in relay plugin.
—
Fixed in version 3.2.1 ().
-
WSA-2020-3: [IRC] Buffer overflow on new IRC message 005 with nick prefixes.
—
Fixed in version 2.7.1 ().
-
WSA-2020-2: [IRC] Crash on malformed IRC message 352 (WHO).
—
Fixed in version 2.7.1 ().
-
WSA-2020-1: [IRC] Buffer overflow on malformed IRC message 324 (channel mode).
—
Fixed in version 2.7.1 ().
-
WSA-2017-2: [Logger] Use of invalid pointer in build of log filename.
—
Fixed in version 1.9.1 ().
Affected by 28 vulnerabilities:
-
WSA-2026-30: [Xfer] Incoming files and chats auto-accepted from a nick on the wrong server.
—
Fixed in version 4.10.3 ().
-
WSA-2026-28: [Xfer] Missing checks of the resume position received in DCC RESUME and DCC ACCEPT.
—
Fixed in version 4.10.3 ().
-
WSA-2026-27: [Relay] Denial of service with huge IRC messages received from a relay client.
—
Fixed in version 4.10.3 ().
-
WSA-2026-25: [IRC] Evaluation of untrusted strings received from the IRC server or an IRC URL.
—
Fixed in version 4.10.2 ().
-
WSA-2026-24: [Relay] Missing size limit for HTTP headers received from a client.
—
Fixed in version 4.10.2 ().
-
WSA-2026-23: [Core] Heap buffer overflow in charset conversion.
—
Fixed in version 4.10.2 ().
-
WSA-2026-22: [Relay] Heap buffer overflow in path of hdata sent to clients with "weechat" protocol.
—
Fixed in version 4.10.2 ().
-
WSA-2026-20: [Relay] Missing size limit of data queued for sending to clients.
—
Fixed in version 4.10.1 ().
-
WSA-2026-19: [Relay] Missing rejection of invalid websocket frames.
—
Fixed in version 4.10.1 ().
-
WSA-2026-18: [Relay] Missing size limit for the unterminated Relay text message received from a client.
—
Fixed in version 4.10.1 ().
-
WSA-2026-17: [Xfer] Bypass of user authorization for start of DCC file transfer.
—
Fixed in version 4.10.1 ().
-
WSA-2026-16: [Xfer] Missing size limit for the unterminated Xfer chat message.
—
Fixed in version 4.10.1 ().
-
WSA-2026-15: [Xfer] Write of DCC file received outside of configured download path.
—
Fixed in version 4.10.1 ().
-
WSA-2026-12: [IRC] Stack buffer overflow when building a JOIN command with channel keys.
—
Fixed in version 4.9.5 ().
-
WSA-2026-11: [Logger] Write of logger file outside of configured path.
—
Fixed in version 4.9.4 ().
-
WSA-2026-7: [Xfer] Buffer overflow when receiving a line in a Xfer chat (DCC chat) buffer.
—
Fixed in version 4.9.2 ().
-
WSA-2026-6: [Xfer] Write of DCC file received outside of configured download path.
—
Fixed in version 4.9.2 ().
-
WSA-2026-4: [Relay] Missing size limit for the received websocket frame, HTTP message and HTTP body.
—
Fixed in version 4.9.2 ().
-
WSA-2026-3: [IRC] Missing size limit for the unterminated IRC message or isupport value (message 005).
—
Fixed in version 4.9.2 ().
-
WSA-2026-2: [API, Relay] Non-constant time password/hash comparison.
—
Fixed in version 4.9.1 ().
-
WSA-2025-3: [Core] Integer overflow in conversion of version to an integer number.
—
Fixed in version 4.6.3 ().
-
WSA-2024-1: [Core, Plugins] Integer overflow in loops on lists.
—
Fixed in version 4.4.2 ().
-
WSA-2021-1: [Relay] Crash on malformed websocket frame in relay plugin.
—
Fixed in version 3.2.1 ().
-
WSA-2020-3: [IRC] Buffer overflow on new IRC message 005 with nick prefixes.
—
Fixed in version 2.7.1 ().
-
WSA-2020-2: [IRC] Crash on malformed IRC message 352 (WHO).
—
Fixed in version 2.7.1 ().
-
WSA-2020-1: [IRC] Buffer overflow on malformed IRC message 324 (channel mode).
—
Fixed in version 2.7.1 ().
-
WSA-2017-2: [Logger] Use of invalid pointer in build of log filename.
—
Fixed in version 1.9.1 ().
-
WSA-2017-1: [IRC] Buffer overflow when receiving a DCC file.
—
Fixed in version 1.7.1 ().
Affected by 28 vulnerabilities:
-
WSA-2026-30: [Xfer] Incoming files and chats auto-accepted from a nick on the wrong server.
—
Fixed in version 4.10.3 ().
-
WSA-2026-28: [Xfer] Missing checks of the resume position received in DCC RESUME and DCC ACCEPT.
—
Fixed in version 4.10.3 ().
-
WSA-2026-27: [Relay] Denial of service with huge IRC messages received from a relay client.
—
Fixed in version 4.10.3 ().
-
WSA-2026-25: [IRC] Evaluation of untrusted strings received from the IRC server or an IRC URL.
—
Fixed in version 4.10.2 ().
-
WSA-2026-24: [Relay] Missing size limit for HTTP headers received from a client.
—
Fixed in version 4.10.2 ().
-
WSA-2026-23: [Core] Heap buffer overflow in charset conversion.
—
Fixed in version 4.10.2 ().
-
WSA-2026-22: [Relay] Heap buffer overflow in path of hdata sent to clients with "weechat" protocol.
—
Fixed in version 4.10.2 ().
-
WSA-2026-20: [Relay] Missing size limit of data queued for sending to clients.
—
Fixed in version 4.10.1 ().
-
WSA-2026-19: [Relay] Missing rejection of invalid websocket frames.
—
Fixed in version 4.10.1 ().
-
WSA-2026-18: [Relay] Missing size limit for the unterminated Relay text message received from a client.
—
Fixed in version 4.10.1 ().
-
WSA-2026-17: [Xfer] Bypass of user authorization for start of DCC file transfer.
—
Fixed in version 4.10.1 ().
-
WSA-2026-16: [Xfer] Missing size limit for the unterminated Xfer chat message.
—
Fixed in version 4.10.1 ().
-
WSA-2026-15: [Xfer] Write of DCC file received outside of configured download path.
—
Fixed in version 4.10.1 ().
-
WSA-2026-12: [IRC] Stack buffer overflow when building a JOIN command with channel keys.
—
Fixed in version 4.9.5 ().
-
WSA-2026-11: [Logger] Write of logger file outside of configured path.
—
Fixed in version 4.9.4 ().
-
WSA-2026-7: [Xfer] Buffer overflow when receiving a line in a Xfer chat (DCC chat) buffer.
—
Fixed in version 4.9.2 ().
-
WSA-2026-6: [Xfer] Write of DCC file received outside of configured download path.
—
Fixed in version 4.9.2 ().
-
WSA-2026-4: [Relay] Missing size limit for the received websocket frame, HTTP message and HTTP body.
—
Fixed in version 4.9.2 ().
-
WSA-2026-3: [IRC] Missing size limit for the unterminated IRC message or isupport value (message 005).
—
Fixed in version 4.9.2 ().
-
WSA-2026-2: [API, Relay] Non-constant time password/hash comparison.
—
Fixed in version 4.9.1 ().
-
WSA-2025-3: [Core] Integer overflow in conversion of version to an integer number.
—
Fixed in version 4.6.3 ().
-
WSA-2024-1: [Core, Plugins] Integer overflow in loops on lists.
—
Fixed in version 4.4.2 ().
-
WSA-2021-1: [Relay] Crash on malformed websocket frame in relay plugin.
—
Fixed in version 3.2.1 ().
-
WSA-2020-3: [IRC] Buffer overflow on new IRC message 005 with nick prefixes.
—
Fixed in version 2.7.1 ().
-
WSA-2020-2: [IRC] Crash on malformed IRC message 352 (WHO).
—
Fixed in version 2.7.1 ().
-
WSA-2020-1: [IRC] Buffer overflow on malformed IRC message 324 (channel mode).
—
Fixed in version 2.7.1 ().
-
WSA-2017-2: [Logger] Use of invalid pointer in build of log filename.
—
Fixed in version 1.9.1 ().
-
WSA-2017-1: [IRC] Buffer overflow when receiving a DCC file.
—
Fixed in version 1.7.1 ().
Affected by 28 vulnerabilities:
-
WSA-2026-30: [Xfer] Incoming files and chats auto-accepted from a nick on the wrong server.
—
Fixed in version 4.10.3 ().
-
WSA-2026-28: [Xfer] Missing checks of the resume position received in DCC RESUME and DCC ACCEPT.
—
Fixed in version 4.10.3 ().
-
WSA-2026-27: [Relay] Denial of service with huge IRC messages received from a relay client.
—
Fixed in version 4.10.3 ().
-
WSA-2026-25: [IRC] Evaluation of untrusted strings received from the IRC server or an IRC URL.
—
Fixed in version 4.10.2 ().
-
WSA-2026-24: [Relay] Missing size limit for HTTP headers received from a client.
—
Fixed in version 4.10.2 ().
-
WSA-2026-23: [Core] Heap buffer overflow in charset conversion.
—
Fixed in version 4.10.2 ().
-
WSA-2026-22: [Relay] Heap buffer overflow in path of hdata sent to clients with "weechat" protocol.
—
Fixed in version 4.10.2 ().
-
WSA-2026-20: [Relay] Missing size limit of data queued for sending to clients.
—
Fixed in version 4.10.1 ().
-
WSA-2026-19: [Relay] Missing rejection of invalid websocket frames.
—
Fixed in version 4.10.1 ().
-
WSA-2026-18: [Relay] Missing size limit for the unterminated Relay text message received from a client.
—
Fixed in version 4.10.1 ().
-
WSA-2026-17: [Xfer] Bypass of user authorization for start of DCC file transfer.
—
Fixed in version 4.10.1 ().
-
WSA-2026-16: [Xfer] Missing size limit for the unterminated Xfer chat message.
—
Fixed in version 4.10.1 ().
-
WSA-2026-15: [Xfer] Write of DCC file received outside of configured download path.
—
Fixed in version 4.10.1 ().
-
WSA-2026-12: [IRC] Stack buffer overflow when building a JOIN command with channel keys.
—
Fixed in version 4.9.5 ().
-
WSA-2026-11: [Logger] Write of logger file outside of configured path.
—
Fixed in version 4.9.4 ().
-
WSA-2026-7: [Xfer] Buffer overflow when receiving a line in a Xfer chat (DCC chat) buffer.
—
Fixed in version 4.9.2 ().
-
WSA-2026-6: [Xfer] Write of DCC file received outside of configured download path.
—
Fixed in version 4.9.2 ().
-
WSA-2026-4: [Relay] Missing size limit for the received websocket frame, HTTP message and HTTP body.
—
Fixed in version 4.9.2 ().
-
WSA-2026-3: [IRC] Missing size limit for the unterminated IRC message or isupport value (message 005).
—
Fixed in version 4.9.2 ().
-
WSA-2026-2: [API, Relay] Non-constant time password/hash comparison.
—
Fixed in version 4.9.1 ().
-
WSA-2025-3: [Core] Integer overflow in conversion of version to an integer number.
—
Fixed in version 4.6.3 ().
-
WSA-2024-1: [Core, Plugins] Integer overflow in loops on lists.
—
Fixed in version 4.4.2 ().
-
WSA-2021-1: [Relay] Crash on malformed websocket frame in relay plugin.
—
Fixed in version 3.2.1 ().
-
WSA-2020-3: [IRC] Buffer overflow on new IRC message 005 with nick prefixes.
—
Fixed in version 2.7.1 ().
-
WSA-2020-2: [IRC] Crash on malformed IRC message 352 (WHO).
—
Fixed in version 2.7.1 ().
-
WSA-2020-1: [IRC] Buffer overflow on malformed IRC message 324 (channel mode).
—
Fixed in version 2.7.1 ().
-
WSA-2017-2: [Logger] Use of invalid pointer in build of log filename.
—
Fixed in version 1.9.1 ().
-
WSA-2017-1: [IRC] Buffer overflow when receiving a DCC file.
—
Fixed in version 1.7.1 ().
Affected by 27 vulnerabilities:
-
WSA-2026-30: [Xfer] Incoming files and chats auto-accepted from a nick on the wrong server.
—
Fixed in version 4.10.3 ().
-
WSA-2026-28: [Xfer] Missing checks of the resume position received in DCC RESUME and DCC ACCEPT.
—
Fixed in version 4.10.3 ().
-
WSA-2026-27: [Relay] Denial of service with huge IRC messages received from a relay client.
—
Fixed in version 4.10.3 ().
-
WSA-2026-25: [IRC] Evaluation of untrusted strings received from the IRC server or an IRC URL.
—
Fixed in version 4.10.2 ().
-
WSA-2026-24: [Relay] Missing size limit for HTTP headers received from a client.
—
Fixed in version 4.10.2 ().
-
WSA-2026-23: [Core] Heap buffer overflow in charset conversion.
—
Fixed in version 4.10.2 ().
-
WSA-2026-22: [Relay] Heap buffer overflow in path of hdata sent to clients with "weechat" protocol.
—
Fixed in version 4.10.2 ().
-
WSA-2026-20: [Relay] Missing size limit of data queued for sending to clients.
—
Fixed in version 4.10.1 ().
-
WSA-2026-18: [Relay] Missing size limit for the unterminated Relay text message received from a client.
—
Fixed in version 4.10.1 ().
-
WSA-2026-17: [Xfer] Bypass of user authorization for start of DCC file transfer.
—
Fixed in version 4.10.1 ().
-
WSA-2026-16: [Xfer] Missing size limit for the unterminated Xfer chat message.
—
Fixed in version 4.10.1 ().
-
WSA-2026-15: [Xfer] Write of DCC file received outside of configured download path.
—
Fixed in version 4.10.1 ().
-
WSA-2026-12: [IRC] Stack buffer overflow when building a JOIN command with channel keys.
—
Fixed in version 4.9.5 ().
-
WSA-2026-11: [Logger] Write of logger file outside of configured path.
—
Fixed in version 4.9.4 ().
-
WSA-2026-7: [Xfer] Buffer overflow when receiving a line in a Xfer chat (DCC chat) buffer.
—
Fixed in version 4.9.2 ().
-
WSA-2026-6: [Xfer] Write of DCC file received outside of configured download path.
—
Fixed in version 4.9.2 ().
-
WSA-2026-4: [Relay] Missing size limit for the received websocket frame, HTTP message and HTTP body.
—
Fixed in version 4.9.2 ().
-
WSA-2026-3: [IRC] Missing size limit for the unterminated IRC message or isupport value (message 005).
—
Fixed in version 4.9.2 ().
-
WSA-2026-2: [API, Relay] Non-constant time password/hash comparison.
—
Fixed in version 4.9.1 ().
-
WSA-2025-3: [Core] Integer overflow in conversion of version to an integer number.
—
Fixed in version 4.6.3 ().
-
WSA-2024-1: [Core, Plugins] Integer overflow in loops on lists.
—
Fixed in version 4.4.2 ().
-
WSA-2021-1: [Relay] Crash on malformed websocket frame in relay plugin.
—
Fixed in version 3.2.1 ().
-
WSA-2020-3: [IRC] Buffer overflow on new IRC message 005 with nick prefixes.
—
Fixed in version 2.7.1 ().
-
WSA-2020-2: [IRC] Crash on malformed IRC message 352 (WHO).
—
Fixed in version 2.7.1 ().
-
WSA-2020-1: [IRC] Buffer overflow on malformed IRC message 324 (channel mode).
—
Fixed in version 2.7.1 ().
-
WSA-2017-2: [Logger] Use of invalid pointer in build of log filename.
—
Fixed in version 1.9.1 ().
-
WSA-2017-1: [IRC] Buffer overflow when receiving a DCC file.
—
Fixed in version 1.7.1 ().
Affected by 27 vulnerabilities:
-
WSA-2026-30: [Xfer] Incoming files and chats auto-accepted from a nick on the wrong server.
—
Fixed in version 4.10.3 ().
-
WSA-2026-28: [Xfer] Missing checks of the resume position received in DCC RESUME and DCC ACCEPT.
—
Fixed in version 4.10.3 ().
-
WSA-2026-27: [Relay] Denial of service with huge IRC messages received from a relay client.
—
Fixed in version 4.10.3 ().
-
WSA-2026-25: [IRC] Evaluation of untrusted strings received from the IRC server or an IRC URL.
—
Fixed in version 4.10.2 ().
-
WSA-2026-24: [Relay] Missing size limit for HTTP headers received from a client.
—
Fixed in version 4.10.2 ().
-
WSA-2026-23: [Core] Heap buffer overflow in charset conversion.
—
Fixed in version 4.10.2 ().
-
WSA-2026-22: [Relay] Heap buffer overflow in path of hdata sent to clients with "weechat" protocol.
—
Fixed in version 4.10.2 ().
-
WSA-2026-20: [Relay] Missing size limit of data queued for sending to clients.
—
Fixed in version 4.10.1 ().
-
WSA-2026-18: [Relay] Missing size limit for the unterminated Relay text message received from a client.
—
Fixed in version 4.10.1 ().
-
WSA-2026-17: [Xfer] Bypass of user authorization for start of DCC file transfer.
—
Fixed in version 4.10.1 ().
-
WSA-2026-16: [Xfer] Missing size limit for the unterminated Xfer chat message.
—
Fixed in version 4.10.1 ().
-
WSA-2026-15: [Xfer] Write of DCC file received outside of configured download path.
—
Fixed in version 4.10.1 ().
-
WSA-2026-12: [IRC] Stack buffer overflow when building a JOIN command with channel keys.
—
Fixed in version 4.9.5 ().
-
WSA-2026-11: [Logger] Write of logger file outside of configured path.
—
Fixed in version 4.9.4 ().
-
WSA-2026-7: [Xfer] Buffer overflow when receiving a line in a Xfer chat (DCC chat) buffer.
—
Fixed in version 4.9.2 ().
-
WSA-2026-6: [Xfer] Write of DCC file received outside of configured download path.
—
Fixed in version 4.9.2 ().
-
WSA-2026-4: [Relay] Missing size limit for the received websocket frame, HTTP message and HTTP body.
—
Fixed in version 4.9.2 ().
-
WSA-2026-3: [IRC] Missing size limit for the unterminated IRC message or isupport value (message 005).
—
Fixed in version 4.9.2 ().
-
WSA-2026-2: [API, Relay] Non-constant time password/hash comparison.
—
Fixed in version 4.9.1 ().
-
WSA-2025-3: [Core] Integer overflow in conversion of version to an integer number.
—
Fixed in version 4.6.3 ().
-
WSA-2024-1: [Core, Plugins] Integer overflow in loops on lists.
—
Fixed in version 4.4.2 ().
-
WSA-2021-1: [Relay] Crash on malformed websocket frame in relay plugin.
—
Fixed in version 3.2.1 ().
-
WSA-2020-3: [IRC] Buffer overflow on new IRC message 005 with nick prefixes.
—
Fixed in version 2.7.1 ().
-
WSA-2020-2: [IRC] Crash on malformed IRC message 352 (WHO).
—
Fixed in version 2.7.1 ().
-
WSA-2020-1: [IRC] Buffer overflow on malformed IRC message 324 (channel mode).
—
Fixed in version 2.7.1 ().
-
WSA-2017-2: [Logger] Use of invalid pointer in build of log filename.
—
Fixed in version 1.9.1 ().
-
WSA-2017-1: [IRC] Buffer overflow when receiving a DCC file.
—
Fixed in version 1.7.1 ().
Affected by 26 vulnerabilities:
-
WSA-2026-30: [Xfer] Incoming files and chats auto-accepted from a nick on the wrong server.
—
Fixed in version 4.10.3 ().
-
WSA-2026-28: [Xfer] Missing checks of the resume position received in DCC RESUME and DCC ACCEPT.
—
Fixed in version 4.10.3 ().
-
WSA-2026-27: [Relay] Denial of service with huge IRC messages received from a relay client.
—
Fixed in version 4.10.3 ().
-
WSA-2026-25: [IRC] Evaluation of untrusted strings received from the IRC server or an IRC URL.
—
Fixed in version 4.10.2 ().
-
WSA-2026-24: [Relay] Missing size limit for HTTP headers received from a client.
—
Fixed in version 4.10.2 ().
-
WSA-2026-23: [Core] Heap buffer overflow in charset conversion.
—
Fixed in version 4.10.2 ().
-
WSA-2026-22: [Relay] Heap buffer overflow in path of hdata sent to clients with "weechat" protocol.
—
Fixed in version 4.10.2 ().
-
WSA-2026-20: [Relay] Missing size limit of data queued for sending to clients.
—
Fixed in version 4.10.1 ().
-
WSA-2026-18: [Relay] Missing size limit for the unterminated Relay text message received from a client.
—
Fixed in version 4.10.1 ().
-
WSA-2026-17: [Xfer] Bypass of user authorization for start of DCC file transfer.
—
Fixed in version 4.10.1 ().
-
WSA-2026-16: [Xfer] Missing size limit for the unterminated Xfer chat message.
—
Fixed in version 4.10.1 ().
-
WSA-2026-15: [Xfer] Write of DCC file received outside of configured download path.
—
Fixed in version 4.10.1 ().
-
WSA-2026-12: [IRC] Stack buffer overflow when building a JOIN command with channel keys.
—
Fixed in version 4.9.5 ().
-
WSA-2026-11: [Logger] Write of logger file outside of configured path.
—
Fixed in version 4.9.4 ().
-
WSA-2026-6: [Xfer] Write of DCC file received outside of configured download path.
—
Fixed in version 4.9.2 ().
-
WSA-2026-4: [Relay] Missing size limit for the received websocket frame, HTTP message and HTTP body.
—
Fixed in version 4.9.2 ().
-
WSA-2026-3: [IRC] Missing size limit for the unterminated IRC message or isupport value (message 005).
—
Fixed in version 4.9.2 ().
-
WSA-2026-2: [API, Relay] Non-constant time password/hash comparison.
—
Fixed in version 4.9.1 ().
-
WSA-2025-3: [Core] Integer overflow in conversion of version to an integer number.
—
Fixed in version 4.6.3 ().
-
WSA-2024-1: [Core, Plugins] Integer overflow in loops on lists.
—
Fixed in version 4.4.2 ().
-
WSA-2021-1: [Relay] Crash on malformed websocket frame in relay plugin.
—
Fixed in version 3.2.1 ().
-
WSA-2020-3: [IRC] Buffer overflow on new IRC message 005 with nick prefixes.
—
Fixed in version 2.7.1 ().
-
WSA-2020-2: [IRC] Crash on malformed IRC message 352 (WHO).
—
Fixed in version 2.7.1 ().
-
WSA-2020-1: [IRC] Buffer overflow on malformed IRC message 324 (channel mode).
—
Fixed in version 2.7.1 ().
-
WSA-2017-2: [Logger] Use of invalid pointer in build of log filename.
—
Fixed in version 1.9.1 ().
-
WSA-2017-1: [IRC] Buffer overflow when receiving a DCC file.
—
Fixed in version 1.7.1 ().
Affected by 26 vulnerabilities:
-
WSA-2026-30: [Xfer] Incoming files and chats auto-accepted from a nick on the wrong server.
—
Fixed in version 4.10.3 ().
-
WSA-2026-28: [Xfer] Missing checks of the resume position received in DCC RESUME and DCC ACCEPT.
—
Fixed in version 4.10.3 ().
-
WSA-2026-27: [Relay] Denial of service with huge IRC messages received from a relay client.
—
Fixed in version 4.10.3 ().
-
WSA-2026-25: [IRC] Evaluation of untrusted strings received from the IRC server or an IRC URL.
—
Fixed in version 4.10.2 ().
-
WSA-2026-24: [Relay] Missing size limit for HTTP headers received from a client.
—
Fixed in version 4.10.2 ().
-
WSA-2026-23: [Core] Heap buffer overflow in charset conversion.
—
Fixed in version 4.10.2 ().
-
WSA-2026-22: [Relay] Heap buffer overflow in path of hdata sent to clients with "weechat" protocol.
—
Fixed in version 4.10.2 ().
-
WSA-2026-20: [Relay] Missing size limit of data queued for sending to clients.
—
Fixed in version 4.10.1 ().
-
WSA-2026-18: [Relay] Missing size limit for the unterminated Relay text message received from a client.
—
Fixed in version 4.10.1 ().
-
WSA-2026-17: [Xfer] Bypass of user authorization for start of DCC file transfer.
—
Fixed in version 4.10.1 ().
-
WSA-2026-16: [Xfer] Missing size limit for the unterminated Xfer chat message.
—
Fixed in version 4.10.1 ().
-
WSA-2026-15: [Xfer] Write of DCC file received outside of configured download path.
—
Fixed in version 4.10.1 ().
-
WSA-2026-12: [IRC] Stack buffer overflow when building a JOIN command with channel keys.
—
Fixed in version 4.9.5 ().
-
WSA-2026-11: [Logger] Write of logger file outside of configured path.
—
Fixed in version 4.9.4 ().
-
WSA-2026-6: [Xfer] Write of DCC file received outside of configured download path.
—
Fixed in version 4.9.2 ().
-
WSA-2026-4: [Relay] Missing size limit for the received websocket frame, HTTP message and HTTP body.
—
Fixed in version 4.9.2 ().
-
WSA-2026-3: [IRC] Missing size limit for the unterminated IRC message or isupport value (message 005).
—
Fixed in version 4.9.2 ().
-
WSA-2026-2: [API, Relay] Non-constant time password/hash comparison.
—
Fixed in version 4.9.1 ().
-
WSA-2025-3: [Core] Integer overflow in conversion of version to an integer number.
—
Fixed in version 4.6.3 ().
-
WSA-2024-1: [Core, Plugins] Integer overflow in loops on lists.
—
Fixed in version 4.4.2 ().
-
WSA-2021-1: [Relay] Crash on malformed websocket frame in relay plugin.
—
Fixed in version 3.2.1 ().
-
WSA-2020-3: [IRC] Buffer overflow on new IRC message 005 with nick prefixes.
—
Fixed in version 2.7.1 ().
-
WSA-2020-2: [IRC] Crash on malformed IRC message 352 (WHO).
—
Fixed in version 2.7.1 ().
-
WSA-2020-1: [IRC] Buffer overflow on malformed IRC message 324 (channel mode).
—
Fixed in version 2.7.1 ().
-
WSA-2017-2: [Logger] Use of invalid pointer in build of log filename.
—
Fixed in version 1.9.1 ().
-
WSA-2017-1: [IRC] Buffer overflow when receiving a DCC file.
—
Fixed in version 1.7.1 ().
Affected by 26 vulnerabilities:
-
WSA-2026-30: [Xfer] Incoming files and chats auto-accepted from a nick on the wrong server.
—
Fixed in version 4.10.3 ().
-
WSA-2026-28: [Xfer] Missing checks of the resume position received in DCC RESUME and DCC ACCEPT.
—
Fixed in version 4.10.3 ().
-
WSA-2026-27: [Relay] Denial of service with huge IRC messages received from a relay client.
—
Fixed in version 4.10.3 ().
-
WSA-2026-25: [IRC] Evaluation of untrusted strings received from the IRC server or an IRC URL.
—
Fixed in version 4.10.2 ().
-
WSA-2026-24: [Relay] Missing size limit for HTTP headers received from a client.
—
Fixed in version 4.10.2 ().
-
WSA-2026-23: [Core] Heap buffer overflow in charset conversion.
—
Fixed in version 4.10.2 ().
-
WSA-2026-22: [Relay] Heap buffer overflow in path of hdata sent to clients with "weechat" protocol.
—
Fixed in version 4.10.2 ().
-
WSA-2026-20: [Relay] Missing size limit of data queued for sending to clients.
—
Fixed in version 4.10.1 ().
-
WSA-2026-18: [Relay] Missing size limit for the unterminated Relay text message received from a client.
—
Fixed in version 4.10.1 ().
-
WSA-2026-17: [Xfer] Bypass of user authorization for start of DCC file transfer.
—
Fixed in version 4.10.1 ().
-
WSA-2026-16: [Xfer] Missing size limit for the unterminated Xfer chat message.
—
Fixed in version 4.10.1 ().
-
WSA-2026-15: [Xfer] Write of DCC file received outside of configured download path.
—
Fixed in version 4.10.1 ().
-
WSA-2026-12: [IRC] Stack buffer overflow when building a JOIN command with channel keys.
—
Fixed in version 4.9.5 ().
-
WSA-2026-11: [Logger] Write of logger file outside of configured path.
—
Fixed in version 4.9.4 ().
-
WSA-2026-6: [Xfer] Write of DCC file received outside of configured download path.
—
Fixed in version 4.9.2 ().
-
WSA-2026-4: [Relay] Missing size limit for the received websocket frame, HTTP message and HTTP body.
—
Fixed in version 4.9.2 ().
-
WSA-2026-3: [IRC] Missing size limit for the unterminated IRC message or isupport value (message 005).
—
Fixed in version 4.9.2 ().
-
WSA-2026-2: [API, Relay] Non-constant time password/hash comparison.
—
Fixed in version 4.9.1 ().
-
WSA-2025-3: [Core] Integer overflow in conversion of version to an integer number.
—
Fixed in version 4.6.3 ().
-
WSA-2024-1: [Core, Plugins] Integer overflow in loops on lists.
—
Fixed in version 4.4.2 ().
-
WSA-2021-1: [Relay] Crash on malformed websocket frame in relay plugin.
—
Fixed in version 3.2.1 ().
-
WSA-2020-3: [IRC] Buffer overflow on new IRC message 005 with nick prefixes.
—
Fixed in version 2.7.1 ().
-
WSA-2020-2: [IRC] Crash on malformed IRC message 352 (WHO).
—
Fixed in version 2.7.1 ().
-
WSA-2020-1: [IRC] Buffer overflow on malformed IRC message 324 (channel mode).
—
Fixed in version 2.7.1 ().
-
WSA-2017-2: [Logger] Use of invalid pointer in build of log filename.
—
Fixed in version 1.9.1 ().
-
WSA-2017-1: [IRC] Buffer overflow when receiving a DCC file.
—
Fixed in version 1.7.1 ().
Affected by 26 vulnerabilities:
-
WSA-2026-30: [Xfer] Incoming files and chats auto-accepted from a nick on the wrong server.
—
Fixed in version 4.10.3 ().
-
WSA-2026-28: [Xfer] Missing checks of the resume position received in DCC RESUME and DCC ACCEPT.
—
Fixed in version 4.10.3 ().
-
WSA-2026-27: [Relay] Denial of service with huge IRC messages received from a relay client.
—
Fixed in version 4.10.3 ().
-
WSA-2026-25: [IRC] Evaluation of untrusted strings received from the IRC server or an IRC URL.
—
Fixed in version 4.10.2 ().
-
WSA-2026-24: [Relay] Missing size limit for HTTP headers received from a client.
—
Fixed in version 4.10.2 ().
-
WSA-2026-23: [Core] Heap buffer overflow in charset conversion.
—
Fixed in version 4.10.2 ().
-
WSA-2026-22: [Relay] Heap buffer overflow in path of hdata sent to clients with "weechat" protocol.
—
Fixed in version 4.10.2 ().
-
WSA-2026-20: [Relay] Missing size limit of data queued for sending to clients.
—
Fixed in version 4.10.1 ().
-
WSA-2026-18: [Relay] Missing size limit for the unterminated Relay text message received from a client.
—
Fixed in version 4.10.1 ().
-
WSA-2026-17: [Xfer] Bypass of user authorization for start of DCC file transfer.
—
Fixed in version 4.10.1 ().
-
WSA-2026-16: [Xfer] Missing size limit for the unterminated Xfer chat message.
—
Fixed in version 4.10.1 ().
-
WSA-2026-15: [Xfer] Write of DCC file received outside of configured download path.
—
Fixed in version 4.10.1 ().
-
WSA-2026-12: [IRC] Stack buffer overflow when building a JOIN command with channel keys.
—
Fixed in version 4.9.5 ().
-
WSA-2026-11: [Logger] Write of logger file outside of configured path.
—
Fixed in version 4.9.4 ().
-
WSA-2026-6: [Xfer] Write of DCC file received outside of configured download path.
—
Fixed in version 4.9.2 ().
-
WSA-2026-4: [Relay] Missing size limit for the received websocket frame, HTTP message and HTTP body.
—
Fixed in version 4.9.2 ().
-
WSA-2026-3: [IRC] Missing size limit for the unterminated IRC message or isupport value (message 005).
—
Fixed in version 4.9.2 ().
-
WSA-2026-2: [API, Relay] Non-constant time password/hash comparison.
—
Fixed in version 4.9.1 ().
-
WSA-2025-3: [Core] Integer overflow in conversion of version to an integer number.
—
Fixed in version 4.6.3 ().
-
WSA-2024-1: [Core, Plugins] Integer overflow in loops on lists.
—
Fixed in version 4.4.2 ().
-
WSA-2021-1: [Relay] Crash on malformed websocket frame in relay plugin.
—
Fixed in version 3.2.1 ().
-
WSA-2020-3: [IRC] Buffer overflow on new IRC message 005 with nick prefixes.
—
Fixed in version 2.7.1 ().
-
WSA-2020-2: [IRC] Crash on malformed IRC message 352 (WHO).
—
Fixed in version 2.7.1 ().
-
WSA-2020-1: [IRC] Buffer overflow on malformed IRC message 324 (channel mode).
—
Fixed in version 2.7.1 ().
-
WSA-2017-2: [Logger] Use of invalid pointer in build of log filename.
—
Fixed in version 1.9.1 ().
-
WSA-2017-1: [IRC] Buffer overflow when receiving a DCC file.
—
Fixed in version 1.7.1 ().
Affected by 26 vulnerabilities:
-
WSA-2026-30: [Xfer] Incoming files and chats auto-accepted from a nick on the wrong server.
—
Fixed in version 4.10.3 ().
-
WSA-2026-28: [Xfer] Missing checks of the resume position received in DCC RESUME and DCC ACCEPT.
—
Fixed in version 4.10.3 ().
-
WSA-2026-27: [Relay] Denial of service with huge IRC messages received from a relay client.
—
Fixed in version 4.10.3 ().
-
WSA-2026-25: [IRC] Evaluation of untrusted strings received from the IRC server or an IRC URL.
—
Fixed in version 4.10.2 ().
-
WSA-2026-24: [Relay] Missing size limit for HTTP headers received from a client.
—
Fixed in version 4.10.2 ().
-
WSA-2026-23: [Core] Heap buffer overflow in charset conversion.
—
Fixed in version 4.10.2 ().
-
WSA-2026-22: [Relay] Heap buffer overflow in path of hdata sent to clients with "weechat" protocol.
—
Fixed in version 4.10.2 ().
-
WSA-2026-20: [Relay] Missing size limit of data queued for sending to clients.
—
Fixed in version 4.10.1 ().
-
WSA-2026-18: [Relay] Missing size limit for the unterminated Relay text message received from a client.
—
Fixed in version 4.10.1 ().
-
WSA-2026-17: [Xfer] Bypass of user authorization for start of DCC file transfer.
—
Fixed in version 4.10.1 ().
-
WSA-2026-16: [Xfer] Missing size limit for the unterminated Xfer chat message.
—
Fixed in version 4.10.1 ().
-
WSA-2026-15: [Xfer] Write of DCC file received outside of configured download path.
—
Fixed in version 4.10.1 ().
-
WSA-2026-12: [IRC] Stack buffer overflow when building a JOIN command with channel keys.
—
Fixed in version 4.9.5 ().
-
WSA-2026-11: [Logger] Write of logger file outside of configured path.
—
Fixed in version 4.9.4 ().
-
WSA-2026-6: [Xfer] Write of DCC file received outside of configured download path.
—
Fixed in version 4.9.2 ().
-
WSA-2026-4: [Relay] Missing size limit for the received websocket frame, HTTP message and HTTP body.
—
Fixed in version 4.9.2 ().
-
WSA-2026-3: [IRC] Missing size limit for the unterminated IRC message or isupport value (message 005).
—
Fixed in version 4.9.2 ().
-
WSA-2026-2: [API, Relay] Non-constant time password/hash comparison.
—
Fixed in version 4.9.1 ().
-
WSA-2025-3: [Core] Integer overflow in conversion of version to an integer number.
—
Fixed in version 4.6.3 ().
-
WSA-2024-1: [Core, Plugins] Integer overflow in loops on lists.
—
Fixed in version 4.4.2 ().
-
WSA-2021-1: [Relay] Crash on malformed websocket frame in relay plugin.
—
Fixed in version 3.2.1 ().
-
WSA-2020-3: [IRC] Buffer overflow on new IRC message 005 with nick prefixes.
—
Fixed in version 2.7.1 ().
-
WSA-2020-2: [IRC] Crash on malformed IRC message 352 (WHO).
—
Fixed in version 2.7.1 ().
-
WSA-2020-1: [IRC] Buffer overflow on malformed IRC message 324 (channel mode).
—
Fixed in version 2.7.1 ().
-
WSA-2017-2: [Logger] Use of invalid pointer in build of log filename.
—
Fixed in version 1.9.1 ().
-
WSA-2017-1: [IRC] Buffer overflow when receiving a DCC file.
—
Fixed in version 1.7.1 ().
Affected by 26 vulnerabilities:
-
WSA-2026-30: [Xfer] Incoming files and chats auto-accepted from a nick on the wrong server.
—
Fixed in version 4.10.3 ().
-
WSA-2026-28: [Xfer] Missing checks of the resume position received in DCC RESUME and DCC ACCEPT.
—
Fixed in version 4.10.3 ().
-
WSA-2026-27: [Relay] Denial of service with huge IRC messages received from a relay client.
—
Fixed in version 4.10.3 ().
-
WSA-2026-25: [IRC] Evaluation of untrusted strings received from the IRC server or an IRC URL.
—
Fixed in version 4.10.2 ().
-
WSA-2026-24: [Relay] Missing size limit for HTTP headers received from a client.
—
Fixed in version 4.10.2 ().
-
WSA-2026-23: [Core] Heap buffer overflow in charset conversion.
—
Fixed in version 4.10.2 ().
-
WSA-2026-22: [Relay] Heap buffer overflow in path of hdata sent to clients with "weechat" protocol.
—
Fixed in version 4.10.2 ().
-
WSA-2026-20: [Relay] Missing size limit of data queued for sending to clients.
—
Fixed in version 4.10.1 ().
-
WSA-2026-18: [Relay] Missing size limit for the unterminated Relay text message received from a client.
—
Fixed in version 4.10.1 ().
-
WSA-2026-17: [Xfer] Bypass of user authorization for start of DCC file transfer.
—
Fixed in version 4.10.1 ().
-
WSA-2026-16: [Xfer] Missing size limit for the unterminated Xfer chat message.
—
Fixed in version 4.10.1 ().
-
WSA-2026-15: [Xfer] Write of DCC file received outside of configured download path.
—
Fixed in version 4.10.1 ().
-
WSA-2026-12: [IRC] Stack buffer overflow when building a JOIN command with channel keys.
—
Fixed in version 4.9.5 ().
-
WSA-2026-11: [Logger] Write of logger file outside of configured path.
—
Fixed in version 4.9.4 ().
-
WSA-2026-6: [Xfer] Write of DCC file received outside of configured download path.
—
Fixed in version 4.9.2 ().
-
WSA-2026-4: [Relay] Missing size limit for the received websocket frame, HTTP message and HTTP body.
—
Fixed in version 4.9.2 ().
-
WSA-2026-3: [IRC] Missing size limit for the unterminated IRC message or isupport value (message 005).
—
Fixed in version 4.9.2 ().
-
WSA-2026-2: [API, Relay] Non-constant time password/hash comparison.
—
Fixed in version 4.9.1 ().
-
WSA-2025-3: [Core] Integer overflow in conversion of version to an integer number.
—
Fixed in version 4.6.3 ().
-
WSA-2024-1: [Core, Plugins] Integer overflow in loops on lists.
—
Fixed in version 4.4.2 ().
-
WSA-2021-1: [Relay] Crash on malformed websocket frame in relay plugin.
—
Fixed in version 3.2.1 ().
-
WSA-2020-3: [IRC] Buffer overflow on new IRC message 005 with nick prefixes.
—
Fixed in version 2.7.1 ().
-
WSA-2020-2: [IRC] Crash on malformed IRC message 352 (WHO).
—
Fixed in version 2.7.1 ().
-
WSA-2020-1: [IRC] Buffer overflow on malformed IRC message 324 (channel mode).
—
Fixed in version 2.7.1 ().
-
WSA-2017-2: [Logger] Use of invalid pointer in build of log filename.
—
Fixed in version 1.9.1 ().
-
WSA-2017-1: [IRC] Buffer overflow when receiving a DCC file.
—
Fixed in version 1.7.1 ().
Affected by 26 vulnerabilities:
-
WSA-2026-30: [Xfer] Incoming files and chats auto-accepted from a nick on the wrong server.
—
Fixed in version 4.10.3 ().
-
WSA-2026-28: [Xfer] Missing checks of the resume position received in DCC RESUME and DCC ACCEPT.
—
Fixed in version 4.10.3 ().
-
WSA-2026-27: [Relay] Denial of service with huge IRC messages received from a relay client.
—
Fixed in version 4.10.3 ().
-
WSA-2026-25: [IRC] Evaluation of untrusted strings received from the IRC server or an IRC URL.
—
Fixed in version 4.10.2 ().
-
WSA-2026-24: [Relay] Missing size limit for HTTP headers received from a client.
—
Fixed in version 4.10.2 ().
-
WSA-2026-23: [Core] Heap buffer overflow in charset conversion.
—
Fixed in version 4.10.2 ().
-
WSA-2026-22: [Relay] Heap buffer overflow in path of hdata sent to clients with "weechat" protocol.
—
Fixed in version 4.10.2 ().
-
WSA-2026-20: [Relay] Missing size limit of data queued for sending to clients.
—
Fixed in version 4.10.1 ().
-
WSA-2026-18: [Relay] Missing size limit for the unterminated Relay text message received from a client.
—
Fixed in version 4.10.1 ().
-
WSA-2026-17: [Xfer] Bypass of user authorization for start of DCC file transfer.
—
Fixed in version 4.10.1 ().
-
WSA-2026-16: [Xfer] Missing size limit for the unterminated Xfer chat message.
—
Fixed in version 4.10.1 ().
-
WSA-2026-15: [Xfer] Write of DCC file received outside of configured download path.
—
Fixed in version 4.10.1 ().
-
WSA-2026-12: [IRC] Stack buffer overflow when building a JOIN command with channel keys.
—
Fixed in version 4.9.5 ().
-
WSA-2026-11: [Logger] Write of logger file outside of configured path.
—
Fixed in version 4.9.4 ().
-
WSA-2026-6: [Xfer] Write of DCC file received outside of configured download path.
—
Fixed in version 4.9.2 ().
-
WSA-2026-4: [Relay] Missing size limit for the received websocket frame, HTTP message and HTTP body.
—
Fixed in version 4.9.2 ().
-
WSA-2026-3: [IRC] Missing size limit for the unterminated IRC message or isupport value (message 005).
—
Fixed in version 4.9.2 ().
-
WSA-2026-2: [API, Relay] Non-constant time password/hash comparison.
—
Fixed in version 4.9.1 ().
-
WSA-2025-3: [Core] Integer overflow in conversion of version to an integer number.
—
Fixed in version 4.6.3 ().
-
WSA-2024-1: [Core, Plugins] Integer overflow in loops on lists.
—
Fixed in version 4.4.2 ().
-
WSA-2021-1: [Relay] Crash on malformed websocket frame in relay plugin.
—
Fixed in version 3.2.1 ().
-
WSA-2020-3: [IRC] Buffer overflow on new IRC message 005 with nick prefixes.
—
Fixed in version 2.7.1 ().
-
WSA-2020-2: [IRC] Crash on malformed IRC message 352 (WHO).
—
Fixed in version 2.7.1 ().
-
WSA-2020-1: [IRC] Buffer overflow on malformed IRC message 324 (channel mode).
—
Fixed in version 2.7.1 ().
-
WSA-2017-2: [Logger] Use of invalid pointer in build of log filename.
—
Fixed in version 1.9.1 ().
-
WSA-2017-1: [IRC] Buffer overflow when receiving a DCC file.
—
Fixed in version 1.7.1 ().
Affected by 25 vulnerabilities:
-
WSA-2026-30: [Xfer] Incoming files and chats auto-accepted from a nick on the wrong server.
—
Fixed in version 4.10.3 ().
-
WSA-2026-28: [Xfer] Missing checks of the resume position received in DCC RESUME and DCC ACCEPT.
—
Fixed in version 4.10.3 ().
-
WSA-2026-27: [Relay] Denial of service with huge IRC messages received from a relay client.
—
Fixed in version 4.10.3 ().
-
WSA-2026-24: [Relay] Missing size limit for HTTP headers received from a client.
—
Fixed in version 4.10.2 ().
-
WSA-2026-23: [Core] Heap buffer overflow in charset conversion.
—
Fixed in version 4.10.2 ().
-
WSA-2026-22: [Relay] Heap buffer overflow in path of hdata sent to clients with "weechat" protocol.
—
Fixed in version 4.10.2 ().
-
WSA-2026-20: [Relay] Missing size limit of data queued for sending to clients.
—
Fixed in version 4.10.1 ().
-
WSA-2026-18: [Relay] Missing size limit for the unterminated Relay text message received from a client.
—
Fixed in version 4.10.1 ().
-
WSA-2026-17: [Xfer] Bypass of user authorization for start of DCC file transfer.
—
Fixed in version 4.10.1 ().
-
WSA-2026-16: [Xfer] Missing size limit for the unterminated Xfer chat message.
—
Fixed in version 4.10.1 ().
-
WSA-2026-15: [Xfer] Write of DCC file received outside of configured download path.
—
Fixed in version 4.10.1 ().
-
WSA-2026-12: [IRC] Stack buffer overflow when building a JOIN command with channel keys.
—
Fixed in version 4.9.5 ().
-
WSA-2026-11: [Logger] Write of logger file outside of configured path.
—
Fixed in version 4.9.4 ().
-
WSA-2026-6: [Xfer] Write of DCC file received outside of configured download path.
—
Fixed in version 4.9.2 ().
-
WSA-2026-4: [Relay] Missing size limit for the received websocket frame, HTTP message and HTTP body.
—
Fixed in version 4.9.2 ().
-
WSA-2026-3: [IRC] Missing size limit for the unterminated IRC message or isupport value (message 005).
—
Fixed in version 4.9.2 ().
-
WSA-2026-2: [API, Relay] Non-constant time password/hash comparison.
—
Fixed in version 4.9.1 ().
-
WSA-2025-3: [Core] Integer overflow in conversion of version to an integer number.
—
Fixed in version 4.6.3 ().
-
WSA-2024-1: [Core, Plugins] Integer overflow in loops on lists.
—
Fixed in version 4.4.2 ().
-
WSA-2021-1: [Relay] Crash on malformed websocket frame in relay plugin.
—
Fixed in version 3.2.1 ().
-
WSA-2020-3: [IRC] Buffer overflow on new IRC message 005 with nick prefixes.
—
Fixed in version 2.7.1 ().
-
WSA-2020-2: [IRC] Crash on malformed IRC message 352 (WHO).
—
Fixed in version 2.7.1 ().
-
WSA-2020-1: [IRC] Buffer overflow on malformed IRC message 324 (channel mode).
—
Fixed in version 2.7.1 ().
-
WSA-2017-2: [Logger] Use of invalid pointer in build of log filename.
—
Fixed in version 1.9.1 ().
-
WSA-2017-1: [IRC] Buffer overflow when receiving a DCC file.
—
Fixed in version 1.7.1 ().
Affected by 24 vulnerabilities:
-
WSA-2026-28: [Xfer] Missing checks of the resume position received in DCC RESUME and DCC ACCEPT.
—
Fixed in version 4.10.3 ().
-
WSA-2026-23: [Core] Heap buffer overflow in charset conversion.
—
Fixed in version 4.10.2 ().
-
WSA-2026-22: [Relay] Heap buffer overflow in path of hdata sent to clients with "weechat" protocol.
—
Fixed in version 4.10.2 ().
-
WSA-2026-20: [Relay] Missing size limit of data queued for sending to clients.
—
Fixed in version 4.10.1 ().
-
WSA-2026-18: [Relay] Missing size limit for the unterminated Relay text message received from a client.
—
Fixed in version 4.10.1 ().
-
WSA-2026-17: [Xfer] Bypass of user authorization for start of DCC file transfer.
—
Fixed in version 4.10.1 ().
-
WSA-2026-16: [Xfer] Missing size limit for the unterminated Xfer chat message.
—
Fixed in version 4.10.1 ().
-
WSA-2026-15: [Xfer] Write of DCC file received outside of configured download path.
—
Fixed in version 4.10.1 ().
-
WSA-2026-12: [IRC] Stack buffer overflow when building a JOIN command with channel keys.
—
Fixed in version 4.9.5 ().
-
WSA-2026-11: [Logger] Write of logger file outside of configured path.
—
Fixed in version 4.9.4 ().
-
WSA-2026-6: [Xfer] Write of DCC file received outside of configured download path.
—
Fixed in version 4.9.2 ().
-
WSA-2026-4: [Relay] Missing size limit for the received websocket frame, HTTP message and HTTP body.
—
Fixed in version 4.9.2 ().
-
WSA-2026-3: [IRC] Missing size limit for the unterminated IRC message or isupport value (message 005).
—
Fixed in version 4.9.2 ().
-
WSA-2026-2: [API, Relay] Non-constant time password/hash comparison.
—
Fixed in version 4.9.1 ().
-
WSA-2025-3: [Core] Integer overflow in conversion of version to an integer number.
—
Fixed in version 4.6.3 ().
-
WSA-2024-1: [Core, Plugins] Integer overflow in loops on lists.
—
Fixed in version 4.4.2 ().
-
WSA-2020-3: [IRC] Buffer overflow on new IRC message 005 with nick prefixes.
—
Fixed in version 2.7.1 ().
-
WSA-2020-2: [IRC] Crash on malformed IRC message 352 (WHO).
—
Fixed in version 2.7.1 ().
-
WSA-2020-1: [IRC] Buffer overflow on malformed IRC message 324 (channel mode).
—
Fixed in version 2.7.1 ().
-
WSA-2017-2: [Logger] Use of invalid pointer in build of log filename.
—
Fixed in version 1.9.1 ().
-
WSA-2017-1: [IRC] Buffer overflow when receiving a DCC file.
—
Fixed in version 1.7.1 ().
-
WSA-2013-3: [Relay] Crash on IRC commands sent via Relay.
—
Fixed in version 0.4.1 ().
-
WSA-2013-2: [IRC] Crash on send of unknown commands to IRC server.
—
Fixed in version 0.4.1 ().
-
WSA-2013-1: [IRC] Crash on nicks monitored with /notify.
—
Fixed in version 0.4.1 ().
Affected by 23 vulnerabilities:
-
WSA-2026-28: [Xfer] Missing checks of the resume position received in DCC RESUME and DCC ACCEPT.
—
Fixed in version 4.10.3 ().
-
WSA-2026-23: [Core] Heap buffer overflow in charset conversion.
—
Fixed in version 4.10.2 ().
-
WSA-2026-22: [Relay] Heap buffer overflow in path of hdata sent to clients with "weechat" protocol.
—
Fixed in version 4.10.2 ().
-
WSA-2026-20: [Relay] Missing size limit of data queued for sending to clients.
—
Fixed in version 4.10.1 ().
-
WSA-2026-18: [Relay] Missing size limit for the unterminated Relay text message received from a client.
—
Fixed in version 4.10.1 ().
-
WSA-2026-17: [Xfer] Bypass of user authorization for start of DCC file transfer.
—
Fixed in version 4.10.1 ().
-
WSA-2026-16: [Xfer] Missing size limit for the unterminated Xfer chat message.
—
Fixed in version 4.10.1 ().
-
WSA-2026-15: [Xfer] Write of DCC file received outside of configured download path.
—
Fixed in version 4.10.1 ().
-
WSA-2026-12: [IRC] Stack buffer overflow when building a JOIN command with channel keys.
—
Fixed in version 4.9.5 ().
-
WSA-2026-11: [Logger] Write of logger file outside of configured path.
—
Fixed in version 4.9.4 ().
-
WSA-2026-6: [Xfer] Write of DCC file received outside of configured download path.
—
Fixed in version 4.9.2 ().
-
WSA-2026-4: [Relay] Missing size limit for the received websocket frame, HTTP message and HTTP body.
—
Fixed in version 4.9.2 ().
-
WSA-2026-3: [IRC] Missing size limit for the unterminated IRC message or isupport value (message 005).
—
Fixed in version 4.9.2 ().
-
WSA-2026-2: [API, Relay] Non-constant time password/hash comparison.
—
Fixed in version 4.9.1 ().
-
WSA-2025-3: [Core] Integer overflow in conversion of version to an integer number.
—
Fixed in version 4.6.3 ().
-
WSA-2024-1: [Core, Plugins] Integer overflow in loops on lists.
—
Fixed in version 4.4.2 ().
-
WSA-2020-3: [IRC] Buffer overflow on new IRC message 005 with nick prefixes.
—
Fixed in version 2.7.1 ().
-
WSA-2020-1: [IRC] Buffer overflow on malformed IRC message 324 (channel mode).
—
Fixed in version 2.7.1 ().
-
WSA-2017-2: [Logger] Use of invalid pointer in build of log filename.
—
Fixed in version 1.9.1 ().
-
WSA-2017-1: [IRC] Buffer overflow when receiving a DCC file.
—
Fixed in version 1.7.1 ().
-
WSA-2013-3: [Relay] Crash on IRC commands sent via Relay.
—
Fixed in version 0.4.1 ().
-
WSA-2013-2: [IRC] Crash on send of unknown commands to IRC server.
—
Fixed in version 0.4.1 ().
-
WSA-2013-1: [IRC] Crash on nicks monitored with /notify.
—
Fixed in version 0.4.1 ().
Affected by 24 vulnerabilities:
-
WSA-2026-28: [Xfer] Missing checks of the resume position received in DCC RESUME and DCC ACCEPT.
—
Fixed in version 4.10.3 ().
-
WSA-2026-23: [Core] Heap buffer overflow in charset conversion.
—
Fixed in version 4.10.2 ().
-
WSA-2026-22: [Relay] Heap buffer overflow in path of hdata sent to clients with "weechat" protocol.
—
Fixed in version 4.10.2 ().
-
WSA-2026-20: [Relay] Missing size limit of data queued for sending to clients.
—
Fixed in version 4.10.1 ().
-
WSA-2026-18: [Relay] Missing size limit for the unterminated Relay text message received from a client.
—
Fixed in version 4.10.1 ().
-
WSA-2026-17: [Xfer] Bypass of user authorization for start of DCC file transfer.
—
Fixed in version 4.10.1 ().
-
WSA-2026-16: [Xfer] Missing size limit for the unterminated Xfer chat message.
—
Fixed in version 4.10.1 ().
-
WSA-2026-15: [Xfer] Write of DCC file received outside of configured download path.
—
Fixed in version 4.10.1 ().
-
WSA-2026-12: [IRC] Stack buffer overflow when building a JOIN command with channel keys.
—
Fixed in version 4.9.5 ().
-
WSA-2026-11: [Logger] Write of logger file outside of configured path.
—
Fixed in version 4.9.4 ().
-
WSA-2026-6: [Xfer] Write of DCC file received outside of configured download path.
—
Fixed in version 4.9.2 ().
-
WSA-2026-4: [Relay] Missing size limit for the received websocket frame, HTTP message and HTTP body.
—
Fixed in version 4.9.2 ().
-
WSA-2026-3: [IRC] Missing size limit for the unterminated IRC message or isupport value (message 005).
—
Fixed in version 4.9.2 ().
-
WSA-2026-2: [API, Relay] Non-constant time password/hash comparison.
—
Fixed in version 4.9.1 ().
-
WSA-2025-3: [Core] Integer overflow in conversion of version to an integer number.
—
Fixed in version 4.6.3 ().
-
WSA-2024-1: [Core, Plugins] Integer overflow in loops on lists.
—
Fixed in version 4.4.2 ().
-
WSA-2020-3: [IRC] Buffer overflow on new IRC message 005 with nick prefixes.
—
Fixed in version 2.7.1 ().
-
WSA-2020-1: [IRC] Buffer overflow on malformed IRC message 324 (channel mode).
—
Fixed in version 2.7.1 ().
-
WSA-2017-2: [Logger] Use of invalid pointer in build of log filename.
—
Fixed in version 1.9.1 ().
-
WSA-2017-1: [IRC] Buffer overflow when receiving a DCC file.
—
Fixed in version 1.7.1 ().
-
WSA-2013-3: [Relay] Crash on IRC commands sent via Relay.
—
Fixed in version 0.4.1 ().
-
WSA-2013-2: [IRC] Crash on send of unknown commands to IRC server.
—
Fixed in version 0.4.1 ().
-
WSA-2013-1: [IRC] Crash on nicks monitored with /notify.
—
Fixed in version 0.4.1 ().
-
WSA-2012-2: [API] Remote execution of commands via scripts.
—
Fixed in version 0.3.9.2 ().
Affected by 25 vulnerabilities:
-
WSA-2026-28: [Xfer] Missing checks of the resume position received in DCC RESUME and DCC ACCEPT.
—
Fixed in version 4.10.3 ().
-
WSA-2026-23: [Core] Heap buffer overflow in charset conversion.
—
Fixed in version 4.10.2 ().
-
WSA-2026-22: [Relay] Heap buffer overflow in path of hdata sent to clients with "weechat" protocol.
—
Fixed in version 4.10.2 ().
-
WSA-2026-20: [Relay] Missing size limit of data queued for sending to clients.
—
Fixed in version 4.10.1 ().
-
WSA-2026-18: [Relay] Missing size limit for the unterminated Relay text message received from a client.
—
Fixed in version 4.10.1 ().
-
WSA-2026-17: [Xfer] Bypass of user authorization for start of DCC file transfer.
—
Fixed in version 4.10.1 ().
-
WSA-2026-16: [Xfer] Missing size limit for the unterminated Xfer chat message.
—
Fixed in version 4.10.1 ().
-
WSA-2026-15: [Xfer] Write of DCC file received outside of configured download path.
—
Fixed in version 4.10.1 ().
-
WSA-2026-12: [IRC] Stack buffer overflow when building a JOIN command with channel keys.
—
Fixed in version 4.9.5 ().
-
WSA-2026-11: [Logger] Write of logger file outside of configured path.
—
Fixed in version 4.9.4 ().
-
WSA-2026-6: [Xfer] Write of DCC file received outside of configured download path.
—
Fixed in version 4.9.2 ().
-
WSA-2026-4: [Relay] Missing size limit for the received websocket frame, HTTP message and HTTP body.
—
Fixed in version 4.9.2 ().
-
WSA-2026-3: [IRC] Missing size limit for the unterminated IRC message or isupport value (message 005).
—
Fixed in version 4.9.2 ().
-
WSA-2026-2: [API, Relay] Non-constant time password/hash comparison.
—
Fixed in version 4.9.1 ().
-
WSA-2025-3: [Core] Integer overflow in conversion of version to an integer number.
—
Fixed in version 4.6.3 ().
-
WSA-2024-1: [Core, Plugins] Integer overflow in loops on lists.
—
Fixed in version 4.4.2 ().
-
WSA-2020-3: [IRC] Buffer overflow on new IRC message 005 with nick prefixes.
—
Fixed in version 2.7.1 ().
-
WSA-2020-1: [IRC] Buffer overflow on malformed IRC message 324 (channel mode).
—
Fixed in version 2.7.1 ().
-
WSA-2017-2: [Logger] Use of invalid pointer in build of log filename.
—
Fixed in version 1.9.1 ().
-
WSA-2017-1: [IRC] Buffer overflow when receiving a DCC file.
—
Fixed in version 1.7.1 ().
-
WSA-2013-3: [Relay] Crash on IRC commands sent via Relay.
—
Fixed in version 0.4.1 ().
-
WSA-2013-2: [IRC] Crash on send of unknown commands to IRC server.
—
Fixed in version 0.4.1 ().
-
WSA-2013-1: [IRC] Crash on nicks monitored with /notify.
—
Fixed in version 0.4.1 ().
-
WSA-2012-2: [API] Remote execution of commands via scripts.
—
Fixed in version 0.3.9.2 ().
-
WSA-2012-1: [IRC] Crash when decoding IRC colors.
—
Fixed in version 0.3.9.1 ().
Affected by 24 vulnerabilities:
-
WSA-2026-28: [Xfer] Missing checks of the resume position received in DCC RESUME and DCC ACCEPT.
—
Fixed in version 4.10.3 ().
-
WSA-2026-23: [Core] Heap buffer overflow in charset conversion.
—
Fixed in version 4.10.2 ().
-
WSA-2026-22: [Relay] Heap buffer overflow in path of hdata sent to clients with "weechat" protocol.
—
Fixed in version 4.10.2 ().
-
WSA-2026-18: [Relay] Missing size limit for the unterminated Relay text message received from a client.
—
Fixed in version 4.10.1 ().
-
WSA-2026-17: [Xfer] Bypass of user authorization for start of DCC file transfer.
—
Fixed in version 4.10.1 ().
-
WSA-2026-16: [Xfer] Missing size limit for the unterminated Xfer chat message.
—
Fixed in version 4.10.1 ().
-
WSA-2026-15: [Xfer] Write of DCC file received outside of configured download path.
—
Fixed in version 4.10.1 ().
-
WSA-2026-12: [IRC] Stack buffer overflow when building a JOIN command with channel keys.
—
Fixed in version 4.9.5 ().
-
WSA-2026-11: [Logger] Write of logger file outside of configured path.
—
Fixed in version 4.9.4 ().
-
WSA-2026-6: [Xfer] Write of DCC file received outside of configured download path.
—
Fixed in version 4.9.2 ().
-
WSA-2026-4: [Relay] Missing size limit for the received websocket frame, HTTP message and HTTP body.
—
Fixed in version 4.9.2 ().
-
WSA-2026-3: [IRC] Missing size limit for the unterminated IRC message or isupport value (message 005).
—
Fixed in version 4.9.2 ().
-
WSA-2026-2: [API, Relay] Non-constant time password/hash comparison.
—
Fixed in version 4.9.1 ().
-
WSA-2025-3: [Core] Integer overflow in conversion of version to an integer number.
—
Fixed in version 4.6.3 ().
-
WSA-2024-1: [Core, Plugins] Integer overflow in loops on lists.
—
Fixed in version 4.4.2 ().
-
WSA-2020-3: [IRC] Buffer overflow on new IRC message 005 with nick prefixes.
—
Fixed in version 2.7.1 ().
-
WSA-2020-1: [IRC] Buffer overflow on malformed IRC message 324 (channel mode).
—
Fixed in version 2.7.1 ().
-
WSA-2017-2: [Logger] Use of invalid pointer in build of log filename.
—
Fixed in version 1.9.1 ().
-
WSA-2017-1: [IRC] Buffer overflow when receiving a DCC file.
—
Fixed in version 1.7.1 ().
-
WSA-2013-3: [Relay] Crash on IRC commands sent via Relay.
—
Fixed in version 0.4.1 ().
-
WSA-2013-2: [IRC] Crash on send of unknown commands to IRC server.
—
Fixed in version 0.4.1 ().
-
WSA-2013-1: [IRC] Crash on nicks monitored with /notify.
—
Fixed in version 0.4.1 ().
-
WSA-2012-2: [API] Remote execution of commands via scripts.
—
Fixed in version 0.3.9.2 ().
-
WSA-2012-1: [IRC] Crash when decoding IRC colors.
—
Fixed in version 0.3.9.1 ().
Affected by 22 vulnerabilities:
-
WSA-2026-28: [Xfer] Missing checks of the resume position received in DCC RESUME and DCC ACCEPT.
—
Fixed in version 4.10.3 ().
-
WSA-2026-23: [Core] Heap buffer overflow in charset conversion.
—
Fixed in version 4.10.2 ().
-
WSA-2026-22: [Relay] Heap buffer overflow in path of hdata sent to clients with "weechat" protocol.
—
Fixed in version 4.10.2 ().
-
WSA-2026-18: [Relay] Missing size limit for the unterminated Relay text message received from a client.
—
Fixed in version 4.10.1 ().
-
WSA-2026-17: [Xfer] Bypass of user authorization for start of DCC file transfer.
—
Fixed in version 4.10.1 ().
-
WSA-2026-16: [Xfer] Missing size limit for the unterminated Xfer chat message.
—
Fixed in version 4.10.1 ().
-
WSA-2026-15: [Xfer] Write of DCC file received outside of configured download path.
—
Fixed in version 4.10.1 ().
-
WSA-2026-12: [IRC] Stack buffer overflow when building a JOIN command with channel keys.
—
Fixed in version 4.9.5 ().
-
WSA-2026-11: [Logger] Write of logger file outside of configured path.
—
Fixed in version 4.9.4 ().
-
WSA-2026-6: [Xfer] Write of DCC file received outside of configured download path.
—
Fixed in version 4.9.2 ().
-
WSA-2026-4: [Relay] Missing size limit for the received websocket frame, HTTP message and HTTP body.
—
Fixed in version 4.9.2 ().
-
WSA-2026-3: [IRC] Missing size limit for the unterminated IRC message or isupport value (message 005).
—
Fixed in version 4.9.2 ().
-
WSA-2026-2: [API, Relay] Non-constant time password/hash comparison.
—
Fixed in version 4.9.1 ().
-
WSA-2025-3: [Core] Integer overflow in conversion of version to an integer number.
—
Fixed in version 4.6.3 ().
-
WSA-2024-1: [Core, Plugins] Integer overflow in loops on lists.
—
Fixed in version 4.4.2 ().
-
WSA-2020-3: [IRC] Buffer overflow on new IRC message 005 with nick prefixes.
—
Fixed in version 2.7.1 ().
-
WSA-2017-2: [Logger] Use of invalid pointer in build of log filename.
—
Fixed in version 1.9.1 ().
-
WSA-2017-1: [IRC] Buffer overflow when receiving a DCC file.
—
Fixed in version 1.7.1 ().
-
WSA-2013-2: [IRC] Crash on send of unknown commands to IRC server.
—
Fixed in version 0.4.1 ().
-
WSA-2013-1: [IRC] Crash on nicks monitored with /notify.
—
Fixed in version 0.4.1 ().
-
WSA-2012-2: [API] Remote execution of commands via scripts.
—
Fixed in version 0.3.9.2 ().
-
WSA-2012-1: [IRC] Crash when decoding IRC colors.
—
Fixed in version 0.3.9.1 ().
Affected by 19 vulnerabilities:
-
WSA-2026-28: [Xfer] Missing checks of the resume position received in DCC RESUME and DCC ACCEPT.
—
Fixed in version 4.10.3 ().
-
WSA-2026-23: [Core] Heap buffer overflow in charset conversion.
—
Fixed in version 4.10.2 ().
-
WSA-2026-17: [Xfer] Bypass of user authorization for start of DCC file transfer.
—
Fixed in version 4.10.1 ().
-
WSA-2026-16: [Xfer] Missing size limit for the unterminated Xfer chat message.
—
Fixed in version 4.10.1 ().
-
WSA-2026-15: [Xfer] Write of DCC file received outside of configured download path.
—
Fixed in version 4.10.1 ().
-
WSA-2026-12: [IRC] Stack buffer overflow when building a JOIN command with channel keys.
—
Fixed in version 4.9.5 ().
-
WSA-2026-11: [Logger] Write of logger file outside of configured path.
—
Fixed in version 4.9.4 ().
-
WSA-2026-6: [Xfer] Write of DCC file received outside of configured download path.
—
Fixed in version 4.9.2 ().
-
WSA-2026-3: [IRC] Missing size limit for the unterminated IRC message or isupport value (message 005).
—
Fixed in version 4.9.2 ().
-
WSA-2026-2: [API, Relay] Non-constant time password/hash comparison.
—
Fixed in version 4.9.1 ().
-
WSA-2025-3: [Core] Integer overflow in conversion of version to an integer number.
—
Fixed in version 4.6.3 ().
-
WSA-2024-1: [Core, Plugins] Integer overflow in loops on lists.
—
Fixed in version 4.4.2 ().
-
WSA-2020-3: [IRC] Buffer overflow on new IRC message 005 with nick prefixes.
—
Fixed in version 2.7.1 ().
-
WSA-2017-2: [Logger] Use of invalid pointer in build of log filename.
—
Fixed in version 1.9.1 ().
-
WSA-2017-1: [IRC] Buffer overflow when receiving a DCC file.
—
Fixed in version 1.7.1 ().
-
WSA-2013-2: [IRC] Crash on send of unknown commands to IRC server.
—
Fixed in version 0.4.1 ().
-
WSA-2013-1: [IRC] Crash on nicks monitored with /notify.
—
Fixed in version 0.4.1 ().
-
WSA-2012-2: [API] Remote execution of commands via scripts.
—
Fixed in version 0.3.9.2 ().
-
WSA-2012-1: [IRC] Crash when decoding IRC colors.
—
Fixed in version 0.3.9.1 ().
Affected by 16 vulnerabilities:
-
WSA-2026-28: [Xfer] Missing checks of the resume position received in DCC RESUME and DCC ACCEPT.
—
Fixed in version 4.10.3 ().
-
WSA-2026-23: [Core] Heap buffer overflow in charset conversion.
—
Fixed in version 4.10.2 ().
-
WSA-2026-17: [Xfer] Bypass of user authorization for start of DCC file transfer.
—
Fixed in version 4.10.1 ().
-
WSA-2026-16: [Xfer] Missing size limit for the unterminated Xfer chat message.
—
Fixed in version 4.10.1 ().
-
WSA-2026-15: [Xfer] Write of DCC file received outside of configured download path.
—
Fixed in version 4.10.1 ().
-
WSA-2026-11: [Logger] Write of logger file outside of configured path.
—
Fixed in version 4.9.4 ().
-
WSA-2026-6: [Xfer] Write of DCC file received outside of configured download path.
—
Fixed in version 4.9.2 ().
-
WSA-2026-3: [IRC] Missing size limit for the unterminated IRC message or isupport value (message 005).
—
Fixed in version 4.9.2 ().
-
WSA-2026-2: [API, Relay] Non-constant time password/hash comparison.
—
Fixed in version 4.9.1 ().
-
WSA-2025-3: [Core] Integer overflow in conversion of version to an integer number.
—
Fixed in version 4.6.3 ().
-
WSA-2024-1: [Core, Plugins] Integer overflow in loops on lists.
—
Fixed in version 4.4.2 ().
-
WSA-2020-3: [IRC] Buffer overflow on new IRC message 005 with nick prefixes.
—
Fixed in version 2.7.1 ().
-
WSA-2017-2: [Logger] Use of invalid pointer in build of log filename.
—
Fixed in version 1.9.1 ().
-
WSA-2017-1: [IRC] Buffer overflow when receiving a DCC file.
—
Fixed in version 1.7.1 ().
-
WSA-2013-2: [IRC] Crash on send of unknown commands to IRC server.
—
Fixed in version 0.4.1 ().
-
WSA-2012-2: [API] Remote execution of commands via scripts.
—
Fixed in version 0.3.9.2 ().
Affected by 17 vulnerabilities:
-
WSA-2026-28: [Xfer] Missing checks of the resume position received in DCC RESUME and DCC ACCEPT.
—
Fixed in version 4.10.3 ().
-
WSA-2026-23: [Core] Heap buffer overflow in charset conversion.
—
Fixed in version 4.10.2 ().
-
WSA-2026-17: [Xfer] Bypass of user authorization for start of DCC file transfer.
—
Fixed in version 4.10.1 ().
-
WSA-2026-16: [Xfer] Missing size limit for the unterminated Xfer chat message.
—
Fixed in version 4.10.1 ().
-
WSA-2026-15: [Xfer] Write of DCC file received outside of configured download path.
—
Fixed in version 4.10.1 ().
-
WSA-2026-11: [Logger] Write of logger file outside of configured path.
—
Fixed in version 4.9.4 ().
-
WSA-2026-6: [Xfer] Write of DCC file received outside of configured download path.
—
Fixed in version 4.9.2 ().
-
WSA-2026-3: [IRC] Missing size limit for the unterminated IRC message or isupport value (message 005).
—
Fixed in version 4.9.2 ().
-
WSA-2026-2: [API, Relay] Non-constant time password/hash comparison.
—
Fixed in version 4.9.1 ().
-
WSA-2025-3: [Core] Integer overflow in conversion of version to an integer number.
—
Fixed in version 4.6.3 ().
-
WSA-2024-1: [Core, Plugins] Integer overflow in loops on lists.
—
Fixed in version 4.4.2 ().
-
WSA-2020-3: [IRC] Buffer overflow on new IRC message 005 with nick prefixes.
—
Fixed in version 2.7.1 ().
-
WSA-2017-2: [Logger] Use of invalid pointer in build of log filename.
—
Fixed in version 1.9.1 ().
-
WSA-2017-1: [IRC] Buffer overflow when receiving a DCC file.
—
Fixed in version 1.7.1 ().
-
WSA-2013-2: [IRC] Crash on send of unknown commands to IRC server.
—
Fixed in version 0.4.1 ().
-
WSA-2012-2: [API] Remote execution of commands via scripts.
—
Fixed in version 0.3.9.2 ().
-
WSA-2011-1: [IRC] Possible man-in-the-middle attack in TLS connection to IRC server.
—
Fixed in version 0.3.5 ().
Affected by 15 vulnerabilities:
-
WSA-2026-28: [Xfer] Missing checks of the resume position received in DCC RESUME and DCC ACCEPT.
—
Fixed in version 4.10.3 ().
-
WSA-2026-23: [Core] Heap buffer overflow in charset conversion.
—
Fixed in version 4.10.2 ().
-
WSA-2026-17: [Xfer] Bypass of user authorization for start of DCC file transfer.
—
Fixed in version 4.10.1 ().
-
WSA-2026-16: [Xfer] Missing size limit for the unterminated Xfer chat message.
—
Fixed in version 4.10.1 ().
-
WSA-2026-15: [Xfer] Write of DCC file received outside of configured download path.
—
Fixed in version 4.10.1 ().
-
WSA-2026-11: [Logger] Write of logger file outside of configured path.
—
Fixed in version 4.9.4 ().
-
WSA-2026-6: [Xfer] Write of DCC file received outside of configured download path.
—
Fixed in version 4.9.2 ().
-
WSA-2026-3: [IRC] Missing size limit for the unterminated IRC message or isupport value (message 005).
—
Fixed in version 4.9.2 ().
-
WSA-2025-3: [Core] Integer overflow in conversion of version to an integer number.
—
Fixed in version 4.6.3 ().
-
WSA-2024-1: [Core, Plugins] Integer overflow in loops on lists.
—
Fixed in version 4.4.2 ().
-
WSA-2017-2: [Logger] Use of invalid pointer in build of log filename.
—
Fixed in version 1.9.1 ().
-
WSA-2017-1: [IRC] Buffer overflow when receiving a DCC file.
—
Fixed in version 1.7.1 ().
-
WSA-2013-2: [IRC] Crash on send of unknown commands to IRC server.
—
Fixed in version 0.4.1 ().
-
WSA-2012-2: [API] Remote execution of commands via scripts.
—
Fixed in version 0.3.9.2 ().
-
WSA-2011-1: [IRC] Possible man-in-the-middle attack in TLS connection to IRC server.
—
Fixed in version 0.3.5 ().
Affected by 13 vulnerabilities:
-
WSA-2026-28: [Xfer] Missing checks of the resume position received in DCC RESUME and DCC ACCEPT.
—
Fixed in version 4.10.3 ().
-
WSA-2026-23: [Core] Heap buffer overflow in charset conversion.
—
Fixed in version 4.10.2 ().
-
WSA-2026-17: [Xfer] Bypass of user authorization for start of DCC file transfer.
—
Fixed in version 4.10.1 ().
-
WSA-2026-16: [Xfer] Missing size limit for the unterminated Xfer chat message.
—
Fixed in version 4.10.1 ().
-
WSA-2026-15: [Xfer] Write of DCC file received outside of configured download path.
—
Fixed in version 4.10.1 ().
-
WSA-2026-11: [Logger] Write of logger file outside of configured path.
—
Fixed in version 4.9.4 ().
-
WSA-2026-6: [Xfer] Write of DCC file received outside of configured download path.
—
Fixed in version 4.9.2 ().
-
WSA-2025-3: [Core] Integer overflow in conversion of version to an integer number.
—
Fixed in version 4.6.3 ().
-
WSA-2024-1: [Core, Plugins] Integer overflow in loops on lists.
—
Fixed in version 4.4.2 ().
-
WSA-2017-2: [Logger] Use of invalid pointer in build of log filename.
—
Fixed in version 1.9.1 ().
-
WSA-2013-2: [IRC] Crash on send of unknown commands to IRC server.
—
Fixed in version 0.4.1 ().
-
WSA-2012-2: [API] Remote execution of commands via scripts.
—
Fixed in version 0.3.9.2 ().
-
WSA-2011-1: [IRC] Possible man-in-the-middle attack in TLS connection to IRC server.
—
Fixed in version 0.3.5 ().
Affected by 11 vulnerabilities:
-
WSA-2026-28: [Xfer] Missing checks of the resume position received in DCC RESUME and DCC ACCEPT.
—
Fixed in version 4.10.3 ().
-
WSA-2026-23: [Core] Heap buffer overflow in charset conversion.
—
Fixed in version 4.10.2 ().
-
WSA-2026-17: [Xfer] Bypass of user authorization for start of DCC file transfer.
—
Fixed in version 4.10.1 ().
-
WSA-2026-16: [Xfer] Missing size limit for the unterminated Xfer chat message.
—
Fixed in version 4.10.1 ().
-
WSA-2026-15: [Xfer] Write of DCC file received outside of configured download path.
—
Fixed in version 4.10.1 ().
-
WSA-2026-11: [Logger] Write of logger file outside of configured path.
—
Fixed in version 4.9.4 ().
-
WSA-2026-6: [Xfer] Write of DCC file received outside of configured download path.
—
Fixed in version 4.9.2 ().
-
WSA-2024-1: [Core, Plugins] Integer overflow in loops on lists.
—
Fixed in version 4.4.2 ().
-
WSA-2013-2: [IRC] Crash on send of unknown commands to IRC server.
—
Fixed in version 0.4.1 ().
-
WSA-2012-2: [API] Remote execution of commands via scripts.
—
Fixed in version 0.3.9.2 ().
-
WSA-2011-1: [IRC] Possible man-in-the-middle attack in TLS connection to IRC server.
—
Fixed in version 0.3.5 ().
Affected by 11 vulnerabilities:
-
WSA-2026-28: [Xfer] Missing checks of the resume position received in DCC RESUME and DCC ACCEPT.
—
Fixed in version 4.10.3 ().
-
WSA-2026-23: [Core] Heap buffer overflow in charset conversion.
—
Fixed in version 4.10.2 ().
-
WSA-2026-17: [Xfer] Bypass of user authorization for start of DCC file transfer.
—
Fixed in version 4.10.1 ().
-
WSA-2026-16: [Xfer] Missing size limit for the unterminated Xfer chat message.
—
Fixed in version 4.10.1 ().
-
WSA-2026-15: [Xfer] Write of DCC file received outside of configured download path.
—
Fixed in version 4.10.1 ().
-
WSA-2026-11: [Logger] Write of logger file outside of configured path.
—
Fixed in version 4.9.4 ().
-
WSA-2026-6: [Xfer] Write of DCC file received outside of configured download path.
—
Fixed in version 4.9.2 ().
-
WSA-2024-1: [Core, Plugins] Integer overflow in loops on lists.
—
Fixed in version 4.4.2 ().
-
WSA-2013-2: [IRC] Crash on send of unknown commands to IRC server.
—
Fixed in version 0.4.1 ().
-
WSA-2012-2: [API] Remote execution of commands via scripts.
—
Fixed in version 0.3.9.2 ().
-
WSA-2011-1: [IRC] Possible man-in-the-middle attack in TLS connection to IRC server.
—
Fixed in version 0.3.5 ().
Affected by 11 vulnerabilities:
-
WSA-2026-28: [Xfer] Missing checks of the resume position received in DCC RESUME and DCC ACCEPT.
—
Fixed in version 4.10.3 ().
-
WSA-2026-23: [Core] Heap buffer overflow in charset conversion.
—
Fixed in version 4.10.2 ().
-
WSA-2026-17: [Xfer] Bypass of user authorization for start of DCC file transfer.
—
Fixed in version 4.10.1 ().
-
WSA-2026-16: [Xfer] Missing size limit for the unterminated Xfer chat message.
—
Fixed in version 4.10.1 ().
-
WSA-2026-15: [Xfer] Write of DCC file received outside of configured download path.
—
Fixed in version 4.10.1 ().
-
WSA-2026-11: [Logger] Write of logger file outside of configured path.
—
Fixed in version 4.9.4 ().
-
WSA-2026-6: [Xfer] Write of DCC file received outside of configured download path.
—
Fixed in version 4.9.2 ().
-
WSA-2024-1: [Core, Plugins] Integer overflow in loops on lists.
—
Fixed in version 4.4.2 ().
-
WSA-2013-2: [IRC] Crash on send of unknown commands to IRC server.
—
Fixed in version 0.4.1 ().
-
WSA-2012-2: [API] Remote execution of commands via scripts.
—
Fixed in version 0.3.9.2 ().
-
WSA-2011-1: [IRC] Possible man-in-the-middle attack in TLS connection to IRC server.
—
Fixed in version 0.3.5 ().
Affected by 7 vulnerabilities:
-
WSA-2026-23: [Core] Heap buffer overflow in charset conversion.
—
Fixed in version 4.10.2 ().
-
WSA-2026-17: [Xfer] Bypass of user authorization for start of DCC file transfer.
—
Fixed in version 4.10.1 ().
-
WSA-2026-16: [Xfer] Missing size limit for the unterminated Xfer chat message.
—
Fixed in version 4.10.1 ().
-
WSA-2026-15: [Xfer] Write of DCC file received outside of configured download path.
—
Fixed in version 4.10.1 ().
-
WSA-2026-6: [Xfer] Write of DCC file received outside of configured download path.
—
Fixed in version 4.9.2 ().
-
WSA-2024-1: [Core, Plugins] Integer overflow in loops on lists.
—
Fixed in version 4.4.2 ().
-
WSA-2011-1: [IRC] Possible man-in-the-middle attack in TLS connection to IRC server.
—
Fixed in version 0.3.5 ().
Affected by 7 vulnerabilities:
-
WSA-2026-23: [Core] Heap buffer overflow in charset conversion.
—
Fixed in version 4.10.2 ().
-
WSA-2026-17: [Xfer] Bypass of user authorization for start of DCC file transfer.
—
Fixed in version 4.10.1 ().
-
WSA-2026-16: [Xfer] Missing size limit for the unterminated Xfer chat message.
—
Fixed in version 4.10.1 ().
-
WSA-2026-15: [Xfer] Write of DCC file received outside of configured download path.
—
Fixed in version 4.10.1 ().
-
WSA-2026-6: [Xfer] Write of DCC file received outside of configured download path.
—
Fixed in version 4.9.2 ().
-
WSA-2024-1: [Core, Plugins] Integer overflow in loops on lists.
—
Fixed in version 4.4.2 ().
-
WSA-2011-1: [IRC] Possible man-in-the-middle attack in TLS connection to IRC server.
—
Fixed in version 0.3.5 ().
Affected by 7 vulnerabilities:
-
WSA-2026-23: [Core] Heap buffer overflow in charset conversion.
—
Fixed in version 4.10.2 ().
-
WSA-2026-17: [Xfer] Bypass of user authorization for start of DCC file transfer.
—
Fixed in version 4.10.1 ().
-
WSA-2026-16: [Xfer] Missing size limit for the unterminated Xfer chat message.
—
Fixed in version 4.10.1 ().
-
WSA-2026-15: [Xfer] Write of DCC file received outside of configured download path.
—
Fixed in version 4.10.1 ().
-
WSA-2026-6: [Xfer] Write of DCC file received outside of configured download path.
—
Fixed in version 4.9.2 ().
-
WSA-2024-1: [Core, Plugins] Integer overflow in loops on lists.
—
Fixed in version 4.4.2 ().
-
WSA-2011-1: [IRC] Possible man-in-the-middle attack in TLS connection to IRC server.
—
Fixed in version 0.3.5 ().
Affected by 8 vulnerabilities:
-
WSA-2026-23: [Core] Heap buffer overflow in charset conversion.
—
Fixed in version 4.10.2 ().
-
WSA-2026-17: [Xfer] Bypass of user authorization for start of DCC file transfer.
—
Fixed in version 4.10.1 ().
-
WSA-2026-16: [Xfer] Missing size limit for the unterminated Xfer chat message.
—
Fixed in version 4.10.1 ().
-
WSA-2026-15: [Xfer] Write of DCC file received outside of configured download path.
—
Fixed in version 4.10.1 ().
-
WSA-2026-6: [Xfer] Write of DCC file received outside of configured download path.
—
Fixed in version 4.9.2 ().
-
WSA-2024-1: [Core, Plugins] Integer overflow in loops on lists.
—
Fixed in version 4.4.2 ().
-
WSA-2011-1: [IRC] Possible man-in-the-middle attack in TLS connection to IRC server.
—
Fixed in version 0.3.5 ().
-
WSA-2009-1: [IRC] Crash when receiving WeeChat color codes in IRC messages.
—
Fixed in version 0.2.6.1 ().
Affected by 7 vulnerabilities:
-
WSA-2026-23: [Core] Heap buffer overflow in charset conversion.
—
Fixed in version 4.10.2 ().
-
WSA-2026-17: [Xfer] Bypass of user authorization for start of DCC file transfer.
—
Fixed in version 4.10.1 ().
-
WSA-2026-16: [Xfer] Missing size limit for the unterminated Xfer chat message.
—
Fixed in version 4.10.1 ().
-
WSA-2026-15: [Xfer] Write of DCC file received outside of configured download path.
—
Fixed in version 4.10.1 ().
-
WSA-2026-6: [Xfer] Write of DCC file received outside of configured download path.
—
Fixed in version 4.9.2 ().
-
WSA-2024-1: [Core, Plugins] Integer overflow in loops on lists.
—
Fixed in version 4.4.2 ().
-
WSA-2011-1: [IRC] Possible man-in-the-middle attack in TLS connection to IRC server.
—
Fixed in version 0.3.5 ().
Affected by 7 vulnerabilities:
-
WSA-2026-23: [Core] Heap buffer overflow in charset conversion.
—
Fixed in version 4.10.2 ().
-
WSA-2026-17: [Xfer] Bypass of user authorization for start of DCC file transfer.
—
Fixed in version 4.10.1 ().
-
WSA-2026-16: [Xfer] Missing size limit for the unterminated Xfer chat message.
—
Fixed in version 4.10.1 ().
-
WSA-2026-15: [Xfer] Write of DCC file received outside of configured download path.
—
Fixed in version 4.10.1 ().
-
WSA-2026-6: [Xfer] Write of DCC file received outside of configured download path.
—
Fixed in version 4.9.2 ().
-
WSA-2024-1: [Core, Plugins] Integer overflow in loops on lists.
—
Fixed in version 4.4.2 ().
-
WSA-2011-1: [IRC] Possible man-in-the-middle attack in TLS connection to IRC server.
—
Fixed in version 0.3.5 ().
Affected by 7 vulnerabilities:
-
WSA-2026-23: [Core] Heap buffer overflow in charset conversion.
—
Fixed in version 4.10.2 ().
-
WSA-2026-17: [Xfer] Bypass of user authorization for start of DCC file transfer.
—
Fixed in version 4.10.1 ().
-
WSA-2026-16: [Xfer] Missing size limit for the unterminated Xfer chat message.
—
Fixed in version 4.10.1 ().
-
WSA-2026-15: [Xfer] Write of DCC file received outside of configured download path.
—
Fixed in version 4.10.1 ().
-
WSA-2026-6: [Xfer] Write of DCC file received outside of configured download path.
—
Fixed in version 4.9.2 ().
-
WSA-2024-1: [Core, Plugins] Integer overflow in loops on lists.
—
Fixed in version 4.4.2 ().
-
WSA-2011-1: [IRC] Possible man-in-the-middle attack in TLS connection to IRC server.
—
Fixed in version 0.3.5 ().
Affected by 6 vulnerabilities:
-
WSA-2026-17: [Xfer] Bypass of user authorization for start of DCC file transfer.
—
Fixed in version 4.10.1 ().
-
WSA-2026-16: [Xfer] Missing size limit for the unterminated Xfer chat message.
—
Fixed in version 4.10.1 ().
-
WSA-2026-15: [Xfer] Write of DCC file received outside of configured download path.
—
Fixed in version 4.10.1 ().
-
WSA-2026-6: [Xfer] Write of DCC file received outside of configured download path.
—
Fixed in version 4.9.2 ().
-
WSA-2024-1: [Core, Plugins] Integer overflow in loops on lists.
—
Fixed in version 4.4.2 ().
-
WSA-2011-1: [IRC] Possible man-in-the-middle attack in TLS connection to IRC server.
—
Fixed in version 0.3.5 ().
Affected by 6 vulnerabilities:
-
WSA-2026-17: [Xfer] Bypass of user authorization for start of DCC file transfer.
—
Fixed in version 4.10.1 ().
-
WSA-2026-16: [Xfer] Missing size limit for the unterminated Xfer chat message.
—
Fixed in version 4.10.1 ().
-
WSA-2026-15: [Xfer] Write of DCC file received outside of configured download path.
—
Fixed in version 4.10.1 ().
-
WSA-2026-6: [Xfer] Write of DCC file received outside of configured download path.
—
Fixed in version 4.9.2 ().
-
WSA-2024-1: [Core, Plugins] Integer overflow in loops on lists.
—
Fixed in version 4.4.2 ().
-
WSA-2011-1: [IRC] Possible man-in-the-middle attack in TLS connection to IRC server.
—
Fixed in version 0.3.5 ().
Affected by 6 vulnerabilities:
-
WSA-2026-17: [Xfer] Bypass of user authorization for start of DCC file transfer.
—
Fixed in version 4.10.1 ().
-
WSA-2026-16: [Xfer] Missing size limit for the unterminated Xfer chat message.
—
Fixed in version 4.10.1 ().
-
WSA-2026-15: [Xfer] Write of DCC file received outside of configured download path.
—
Fixed in version 4.10.1 ().
-
WSA-2026-6: [Xfer] Write of DCC file received outside of configured download path.
—
Fixed in version 4.9.2 ().
-
WSA-2024-1: [Core, Plugins] Integer overflow in loops on lists.
—
Fixed in version 4.4.2 ().
-
WSA-2011-1: [IRC] Possible man-in-the-middle attack in TLS connection to IRC server.
—
Fixed in version 0.3.5 ().
Affected by 6 vulnerabilities:
-
WSA-2026-17: [Xfer] Bypass of user authorization for start of DCC file transfer.
—
Fixed in version 4.10.1 ().
-
WSA-2026-16: [Xfer] Missing size limit for the unterminated Xfer chat message.
—
Fixed in version 4.10.1 ().
-
WSA-2026-15: [Xfer] Write of DCC file received outside of configured download path.
—
Fixed in version 4.10.1 ().
-
WSA-2026-6: [Xfer] Write of DCC file received outside of configured download path.
—
Fixed in version 4.9.2 ().
-
WSA-2024-1: [Core, Plugins] Integer overflow in loops on lists.
—
Fixed in version 4.4.2 ().
-
WSA-2011-1: [IRC] Possible man-in-the-middle attack in TLS connection to IRC server.
—
Fixed in version 0.3.5 ().
Affected by 6 vulnerabilities:
-
WSA-2026-17: [Xfer] Bypass of user authorization for start of DCC file transfer.
—
Fixed in version 4.10.1 ().
-
WSA-2026-16: [Xfer] Missing size limit for the unterminated Xfer chat message.
—
Fixed in version 4.10.1 ().
-
WSA-2026-15: [Xfer] Write of DCC file received outside of configured download path.
—
Fixed in version 4.10.1 ().
-
WSA-2026-6: [Xfer] Write of DCC file received outside of configured download path.
—
Fixed in version 4.9.2 ().
-
WSA-2024-1: [Core, Plugins] Integer overflow in loops on lists.
—
Fixed in version 4.4.2 ().
-
WSA-2011-1: [IRC] Possible man-in-the-middle attack in TLS connection to IRC server.
—
Fixed in version 0.3.5 ().
Affected by 6 vulnerabilities:
-
WSA-2026-17: [Xfer] Bypass of user authorization for start of DCC file transfer.
—
Fixed in version 4.10.1 ().
-
WSA-2026-16: [Xfer] Missing size limit for the unterminated Xfer chat message.
—
Fixed in version 4.10.1 ().
-
WSA-2026-15: [Xfer] Write of DCC file received outside of configured download path.
—
Fixed in version 4.10.1 ().
-
WSA-2026-6: [Xfer] Write of DCC file received outside of configured download path.
—
Fixed in version 4.9.2 ().
-
WSA-2024-1: [Core, Plugins] Integer overflow in loops on lists.
—
Fixed in version 4.4.2 ().
-
WSA-2011-1: [IRC] Possible man-in-the-middle attack in TLS connection to IRC server.
—
Fixed in version 0.3.5 ().
Affected by 7 vulnerabilities:
-
WSA-2026-17: [Xfer] Bypass of user authorization for start of DCC file transfer.
—
Fixed in version 4.10.1 ().
-
WSA-2026-16: [Xfer] Missing size limit for the unterminated Xfer chat message.
—
Fixed in version 4.10.1 ().
-
WSA-2026-15: [Xfer] Write of DCC file received outside of configured download path.
—
Fixed in version 4.10.1 ().
-
WSA-2026-6: [Xfer] Write of DCC file received outside of configured download path.
—
Fixed in version 4.9.2 ().
-
WSA-2024-1: [Core, Plugins] Integer overflow in loops on lists.
—
Fixed in version 4.4.2 ().
-
WSA-2011-1: [IRC] Possible man-in-the-middle attack in TLS connection to IRC server.
—
Fixed in version 0.3.5 ().
-
WSA-2006-1: [API] Crash in API function infobar_printf.
—
Fixed in version 0.1.7 ().
Affected by 6 vulnerabilities:
-
WSA-2026-17: [Xfer] Bypass of user authorization for start of DCC file transfer.
—
Fixed in version 4.10.1 ().
-
WSA-2026-16: [Xfer] Missing size limit for the unterminated Xfer chat message.
—
Fixed in version 4.10.1 ().
-
WSA-2026-15: [Xfer] Write of DCC file received outside of configured download path.
—
Fixed in version 4.10.1 ().
-
WSA-2026-6: [Xfer] Write of DCC file received outside of configured download path.
—
Fixed in version 4.9.2 ().
-
WSA-2011-1: [IRC] Possible man-in-the-middle attack in TLS connection to IRC server.
—
Fixed in version 0.3.5 ().
-
WSA-2006-1: [API] Crash in API function infobar_printf.
—
Fixed in version 0.1.7 ().
Affected by 6 vulnerabilities:
-
WSA-2026-17: [Xfer] Bypass of user authorization for start of DCC file transfer.
—
Fixed in version 4.10.1 ().
-
WSA-2026-16: [Xfer] Missing size limit for the unterminated Xfer chat message.
—
Fixed in version 4.10.1 ().
-
WSA-2026-15: [Xfer] Write of DCC file received outside of configured download path.
—
Fixed in version 4.10.1 ().
-
WSA-2026-6: [Xfer] Write of DCC file received outside of configured download path.
—
Fixed in version 4.9.2 ().
-
WSA-2011-1: [IRC] Possible man-in-the-middle attack in TLS connection to IRC server.
—
Fixed in version 0.3.5 ().
-
WSA-2006-1: [API] Crash in API function infobar_printf.
—
Fixed in version 0.1.7 ().
Affected by 5 vulnerabilities:
-
WSA-2026-16: [Xfer] Missing size limit for the unterminated Xfer chat message.
—
Fixed in version 4.10.1 ().
-
WSA-2026-15: [Xfer] Write of DCC file received outside of configured download path.
—
Fixed in version 4.10.1 ().
-
WSA-2026-6: [Xfer] Write of DCC file received outside of configured download path.
—
Fixed in version 4.9.2 ().
-
WSA-2011-1: [IRC] Possible man-in-the-middle attack in TLS connection to IRC server.
—
Fixed in version 0.3.5 ().
-
WSA-2006-1: [API] Crash in API function infobar_printf.
—
Fixed in version 0.1.7 ().
Affected by 4 vulnerabilities:
-
WSA-2026-16: [Xfer] Missing size limit for the unterminated Xfer chat message.
—
Fixed in version 4.10.1 ().
-
WSA-2026-15: [Xfer] Write of DCC file received outside of configured download path.
—
Fixed in version 4.10.1 ().
-
WSA-2026-6: [Xfer] Write of DCC file received outside of configured download path.
—
Fixed in version 4.9.2 ().
-
WSA-2006-1: [API] Crash in API function infobar_printf.
—
Fixed in version 0.1.7 ().
Affected by 4 vulnerabilities:
-
WSA-2026-16: [Xfer] Missing size limit for the unterminated Xfer chat message.
—
Fixed in version 4.10.1 ().
-
WSA-2026-15: [Xfer] Write of DCC file received outside of configured download path.
—
Fixed in version 4.10.1 ().
-
WSA-2026-6: [Xfer] Write of DCC file received outside of configured download path.
—
Fixed in version 4.9.2 ().
-
WSA-2006-1: [API] Crash in API function infobar_printf.
—
Fixed in version 0.1.7 ().
Affected by 3 vulnerabilities:
-
WSA-2026-15: [Xfer] Write of DCC file received outside of configured download path.
—
Fixed in version 4.10.1 ().
-
WSA-2026-6: [Xfer] Write of DCC file received outside of configured download path.
—
Fixed in version 4.9.2 ().
-
WSA-2006-1: [API] Crash in API function infobar_printf.
—
Fixed in version 0.1.7 ().
Affected by 3 vulnerabilities:
-
WSA-2026-15: [Xfer] Write of DCC file received outside of configured download path.
—
Fixed in version 4.10.1 ().
-
WSA-2026-6: [Xfer] Write of DCC file received outside of configured download path.
—
Fixed in version 4.9.2 ().
-
WSA-2006-1: [API] Crash in API function infobar_printf.
—
Fixed in version 0.1.7 ().
Affected by 3 vulnerabilities:
-
WSA-2026-15: [Xfer] Write of DCC file received outside of configured download path.
—
Fixed in version 4.10.1 ().
-
WSA-2026-6: [Xfer] Write of DCC file received outside of configured download path.
—
Fixed in version 4.9.2 ().
-
WSA-2006-1: [API] Crash in API function infobar_printf.
—
Fixed in version 0.1.7 ().
Affected by 1 vulnerability:
-
WSA-2006-1: [API] Crash in API function infobar_printf.
—
Fixed in version 0.1.7 ().
Affected by 1 vulnerability:
-
WSA-2006-1: [API] Crash in API function infobar_printf.
—
Fixed in version 0.1.7 ().
Affected by 1 vulnerability:
-
WSA-2006-1: [API] Crash in API function infobar_printf.
—
Fixed in version 0.1.7 ().
Affected by 1 vulnerability:
-
WSA-2004-1: [Core, IRC] Buffer overflows in build of strings.
—
Fixed in version 0.0.5 ().
Affected by 1 vulnerability:
-
WSA-2004-1: [Core, IRC] Buffer overflows in build of strings.
—
Fixed in version 0.0.5 ().
Affected by 1 vulnerability:
-
WSA-2004-1: [Core, IRC] Buffer overflows in build of strings.
—
Fixed in version 0.0.5 ().
Affected by 1 vulnerability:
-
WSA-2004-1: [Core, IRC] Buffer overflows in build of strings.
—
Fixed in version 0.0.5 ().