• WeeChat
• WeeChat Relay
• QWeeChat

• Stable
• Development
• Security

• All vulnerabilities
• Vulnerabilities by version

Security vulnerabilities in version 3.1

This page lists all known and fixed security vulnerabilities in version 3.1 (back to the list of all versions).

Overview: 2 vulnerabilities

WSA-2024-1: [Core, Plugins] Integer overflow in loops on lists.

Vulnerability

Description

An integer overflow can happen when looping over items in a list.
This can only happen in rare conditions on 32 and 64-bit systems, as the list must contain more than 2,147,483,647 elements.
On 16-bit systems, this happens with a list that contains more than 32,767 elements.

Mitigation

There is no known mitigation.
The upgrade to the latest stable version is highly recommended.

Credit

The issue was discovered by Yiheng Cao.

---

WSA-2021-1: [Relay] Crash on malformed websocket frame in relay plugin.

Vulnerability

Description

A crash happens when decoding a malformed websocket frame in relay plugin.
This happens even if a password is set in relay plugin, the malformed websocket frame can be received before the authentication of the client.

Mitigation

There are multiple ways to mitigate this issue:

• Rremove all relays, see: /help relay
• Unload relay plugin with command: /plugin unload relay and see: /help weechat.plugin.autoload
• Secure relay to allow only some trusted IP addresses, see: /help relay.network.allowed_ips

Credit

The issue was discovered by Stuart Nevans Locke.