CVE-2026-53524 - WeeChat has a Decompression Bomb in Relay WebSocket (DoS)
Brief
CVE ID : CVE-2026-53524
Published : Aug. 21, 2026, 11:16 p. m.
- 1 hour, 54 minutes ago
Description : WeeChat (Wee Enhanced Environment for Chat) is a free chat client. In versions 4.
- 0 through 4.
- 0, the WeeChat relay module's WebSocket permessage-deflate decompression function relay_websocket_inflate() has no upper bound on output size.
An authenticated relay user can send a small compressed WebSocket frame (~100 bytes) that decompresses to gigabytes, exhausting all server memory and crashing the entire WeeChat process. The api protocol enables permessage-deflate and requires authentication before WebSocket upgrade. Version 4.
- 1 patches the issue.
Severity: 6.5
- MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...