WeeChat relay WebSocket decompression has no output size limit
WeeChat versions 4.3.0–4.9.0 relay WebSocket handler decompresses frames with no size cap, letting authenticated users send a ~100-byte compressed frame that expands to exhaust server memory. Fixed in 4.9.1.
- Vendor
- WeeChat
- Product
- WeeChat
- CVSS
- 6.5
- EPSS (exploit probability)
- 0.5%
- Status
- patched
- Published
The WeeChat relay module’s WebSocket handler (relay_websocket_inflate()) decompresses incoming frames without enforcing an upper bound on output size. An authenticated relay user can send a small compressed WebSocket frame — approximately 100 bytes — that decompresses to a volume sufficient to exhaust all available server memory and crash the WeeChat process entirely.
The issue affects versions 4.3.0 through 4.9.0. WeeChat 4.9.1 introduces a decompression output cap.
Authentication is required to reach the vulnerable path, placing this vulnerability behind CVE-2026-53525 (the relay timing attack) in a scenario where an attacker has not yet authenticated. Disabling the relay plugin eliminates both attack surfaces.
No active exploitation reported. Responsibly disclosed via GitHub Security Advisories.
