Executive brief
WeeChat is a free chat client used for IRC and other messaging. The relay module (which allows remote connections) contains a decompression flaw that an authenticated attacker can exploit by sending a small compressed message (~100 bytes) that expands to gigabytes, exhausting server memory and crashing the entire WeeChat process. This disrupts all active IRC sessions and connections for the affected user.
Technical details
The vulnerability is a decompression bomb (CWE-409) in the relay_websocket_inflate() function within the WebSocket permessage-deflate decompression handler. The vulnerable code doubles the output buffer size without an upper limit when decompressing data, allowing a highly-compressible zlib stream (e.g., repeated null bytes) to expand unbounded. Attack requires authentication via HTTP Basic or Bearer credentials and network access to the relay port; the permessage-deflate extension is enabled by default for the API protocol. A single malicious compressed WebSocket frame can trigger out-of-memory conditions that terminate the WeeChat process. Version 4.9.1 patches the issue by imposing output size bounds on decompression.
Affected products
- WeeChat WeeChat 4.3.0 through 4.9.0
Timeline
- 2026-05-31: disclosed: GitHub advisory published
- 2026-05-31: patched: Version 4.9.1 released with fix