When queuing data of sending to clients, the Relay plugin builds a partial buffer.
There is no limit for the allocated buffer.
A malicious unauthenticated client sending PING control frames can can lead to memory exhaustion and the WeeChat process can be killed by the OOM killer.
Mitigation
Unload relay plugin with command: /plugin unload relay and see: /help weechat.plugin.autoload.
Credit
The issue was discovered by Acts1631.
WSA-2026-19: [Relay] Missing rejection of invalid websocket frames.
The relay plugin fails to reject invalid websocket frames.
A malicious client sending invalid websocket frames can lead to memory exhaustion and the WeeChat process can be killed by the OOM killer.
Mitigation
Unload relay plugin with command: /plugin unload relay and see: /help weechat.plugin.autoload.
Credit
The issue was discovered by Acts1631.
WSA-2026-18: [Relay] Missing size limit for the unterminated Relay text message received from a client.
When receiving a text message from a client, the Relay plugin builds a partial buffer until the end of text is found.
There is no limit for the allocated buffer.
A malicious client sending large amount of data without end of text can lead to memory exhaustion and the WeeChat process can be killed by the OOM killer.
Mitigation
Unload relay plugin with command: /plugin unload relay and see: /help weechat.plugin.autoload.
Credit
The issue was discovered by Acts1631.
WSA-2026-17: [Xfer] Bypass of user authorization for start of DCC file transfer.
When receiving part of Xfer chat message, the Xfer plugin builds a partial buffer until the end of message is found.
There is no limit for the allocated buffer.
A malicious client sending large amount of data without end of message can lead to memory exhaustion and the WeeChat process can be killed by the OOM killer.
Mitigation
Unload xfer plugin with command: /plugin unload xfer and see: /help weechat.plugin.autoload.
Credit
The issue was discovered by Acts1631.
WSA-2026-15: [Xfer] Write of DCC file received outside of configured download path.
When receiving a DCC file, the filename may contain directory separator that is not the platform-native one (for example "/" received on Windows or "\" received on Linux). This separator may be interpreted as a directory separator, so the file could be written outside of the configured download path.
Xfer never overwrites existing files, so if a file exists with the same name, a suffix like ".1" is appended to the filename.
Mitigation
Unload xfer plugin with command: /plugin unload xfer and see: /help weechat.plugin.autoload.
Credit
The issue was discovered by Acts1631.
WSA-2026-14: [Relay] Use-after-free and double free when a remote relay sends an event with an array as body.
A malicious (or compromised) relay remote can send a "buffer_closed" event with an array, causing a use-after-free (read and write) followed by a double free, in the relay plugin.
Note: if the remote is a trusted WeeChat, the problem does not happen, as WeeChat itself never sends an array in the "buffer_closed" event.
Mitigation
Always connect to a trusted WeeChat remote.
Credit
The issue was discovered by Mohammed Arib (arib06).
WSA-2026-13: [IRC] Use-after-free in the irc plugin when a batched message disconnects the server.
When a batch message is received and one of the messages causes a disconnection from the server, the remaining messages are reading data that is already freed.