CVE-2026-53524

6.5 Moyenne

Publiée le 22/08/2026 à 01:16 · Modifiée le 14/10/2026 à 21:10 · Analyse NVD reportée · Source : security-advisories@github.com

Description

WeeChat (Wee Enhanced Environment for Chat) is a free chat client. In versions 4.3.0 through 4.9.0, the WeeChat relay module's WebSocket permessage-deflate decompression function relay_websocket_inflate() has no upper bound on output size. An authenticated relay user can send a small compressed WebSocket frame (~100 bytes) that decompresses to gigabytes, exhausting all server memory and crashing the entire WeeChat process. The api protocol enables permessage-deflate and requires authentication before WebSocket upgrade. Version 4.9.1 patches the issue.

Traduire en français

Produits concernés

weechat

Scores CVSS

Version	Score	Source	Vecteur
3.1	6.5 Moyenne	security-advisories@github.com	`CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H`

Faiblesses (CWE)

CWE-409

Références

https://github.com/weechat/weechat/security/advisories/GHSA-v2v4-45wm-5cr3
https://github.com/weechat/weechat/security/advisories/GHSA-v2v4-45wm-5cr3

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories