WeeChat uses non-constant time password/hash comparison in the Relay plugin and in TOTP validation.
This could allow an attacker to guess a password, a hash or a TOTP and bypass relay authentication.
Mitigation
There are multiple ways to mitigate this issue:
Rremove all relays, see: /help relay
Unload relay plugin with command: /plugin unload relay and see: /help weechat.plugin.autoload
Secure relay to allow only some trusted IP addresses, see: /help relay.network.allowed_ips
Credit
The issue was discovered by Tristan Madani (@TristanInSec) from Talence Security.
WSA-2025-7: [Core] Buffer overflow in range of chars in evaluated expressions.
Buffer overflow in function util_parse_time when the received date/time has no date and a length of 117 or more chars.
It can be an issue in IRC plugin, where the "time" tag received in IRC messages is parsed using this function.
Mitigation
There is no known mitigation.
The upgrade to the latest stable version is highly recommended.
WSA-2025-3: [Core] Integer overflow in conversion of version to an integer number.
Integer overflow happens in conversion of a version as string to an integer number, if the version is greater than 0x7FFFFFFF (127.255.255.255), so if the version is at least 0x80000000 (128.0.0.0).
Mitigation
There is no known mitigation.
The upgrade to the latest stable version is highly recommended.
WSA-2025-2: [Core] Integer overflow in base32 decode/encode functions.
An integer overflow can happen when looping over items in a list.
This can only happen in rare conditions on 32 and 64-bit systems, as the list must contain more than 2,147,483,647 elements.
On 16-bit systems, this happens with a list that contains more than 32,767 elements.
Mitigation
There is no known mitigation.
The upgrade to the latest stable version is highly recommended.