Allocation of Resources Without Limits or Throttling in WeeChat - #VU164400
Published: November 10, 2026
Vulnerability identifier: #VU164400
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-770
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to exhaust process memory and cause a denial of service before authentication.
The vulnerability exists due to allocation of resources without limits in the WeeChat relay HTTP request parser when accumulating header lines for API requests or WebSocket handshakes, leaving request->raw and repeated header values unbounded. A remote attacker can connect to an enabled, reachable relay port and continuously send header lines without the terminating blank line within the authentication timeout window to exhaust memory.
Affected software
WeeChat
Remediation
Install security update from vendor's website.
WeeChat - update to 4.10.2