SB20261110286 - Multiple vulnerabilities in WeeChat
Published: November 10, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 4 vulnerabilities.
1) Allocation of Resources Without Limits or Throttling (CVE-ID: N/A)
CWE-ID: CWE-770 - Allocation of Resources Without Limits or Throttling
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to exhaust process memory and cause a denial of service before authentication.
The vulnerability exists due to allocation of resources without limits in the WeeChat relay HTTP request parser when accumulating header lines for API requests or WebSocket handshakes, leaving request->raw and repeated header values unbounded. A remote attacker can connect to an enabled, reachable relay port and continuously send header lines without the terminating blank line within the authentication timeout window to exhaust memory.
2) Heap-based buffer overflow (CVE-ID: N/A)
CWE-ID: CWE-122 - Heap-based Buffer Overflow
CVSSv4: 9.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service and potentially execute arbitrary code through heap corruption.
The vulnerability exists due to a heap-based buffer overflow caused by undersized allocation and unchecked replacement-byte writes in WeeChat's string_iconv function when decoding inbound IRC messages using TSCII. A remote attacker can send crafted messages, such as bytes([0x88]) * 2000 + bytes([0xA0]) * 1000, through a controlled IRC server or channel text relayed by an honest server to overflow the heap buffer and potentially hijack control flow.
3) Heap-based buffer overflow (CVE-ID: N/A)
CWE-ID: CWE-122 - Heap-based Buffer Overflow
CVSSv4: 7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote privileged user to corrupt heap memory and cause a denial of service in WeeChat's parent process.
The vulnerability exists due to a heap-based buffer overflow in relay_weechat_msg_add_hdata when expanding hdata paths without checking accumulated output against the allocated buffer size. A remote privileged user can authenticate to an enabled relay port and send an hdata path starting with irc_channel_speaking:0x1 followed by repeated /next_nick segments to overwrite adjacent heap chunks and crash the process, bypassing relay.network.commands restrictions.
4) Heap-based buffer overflow (CVE-ID: N/A)
CWE-ID: CWE-122 - Heap-based Buffer Overflow
CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service by crashing the client.
The vulnerability exists due to a heap-based buffer overflow in WeeChat IRC plugin's irc_nick_set_prefix when indexing stale nick prefix buffers without bounds checks after automatic reconnect. A remote attacker can operate an IRC server the victim connects to, send pre-registration JOIN and 005 messages containing PREFIX=(), force a disconnect, then send a 353 message with a '+'-prefixed nick after automatic reconnect to trigger out-of-bounds reads and writes and crash the client.
Remediation
Install update from vendor's website.