CVE-2026-53524

Received Received - Intake

Memory Exhaustion in WeeChat Relay WebSocket Decompression

Publication date: 2026-08-21

Last updated on: 2026-08-21

Assigner: GitHub, Inc.

Description

WeeChat (Wee Enhanced Environment for Chat) is a free chat client. In versions 4.3.0 through 4.9.0, the WeeChat relay module's WebSocket permessage-deflate decompression function relay_websocket_inflate() has no upper bound on output size. An authenticated relay user can send a small compressed WebSocket frame (~100 bytes) that decompresses to gigabytes, exhausting all server memory and crashing the entire WeeChat process. The api protocol enables permessage-deflate and requires authentication before WebSocket upgrade. Version 4.9.1 patches the issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-21

Last Modified

2026-08-21

Generated

2026-08-22

AI Q&A

2026-08-22

EPSS Evaluated

N/A

NVD

CVE-2026-53524

Affected Vendors & Products

Vendor	Product	Version / Range
weechat	weechat	From 4.3.0 (inc) to 4.9.0 (inc)
weechat	weechat	4.9.1

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-409	The product does not handle or incorrectly handles a compressed input with a very high compression ratio that produces a large output.

Attack-Flow Graph

Executive Summary

This vulnerability affects WeeChat versions 4.3.0 through 4.9.0. The WebSocket permessage-deflate decompression function in the relay module has no limit on output size. An authenticated user can send a small compressed frame that decompresses to gigabytes, crashing the entire WeeChat process by exhausting server memory.

Detection Guidance

Detecting this vulnerability requires monitoring for abnormal memory usage or crashes in WeeChat processes. Check for processes named 'weechat' consuming excessive memory using system monitoring tools like 'top', 'htop', or 'ps aux'. Look for WebSocket connections to the relay port (default 9001) and inspect traffic for unusually large payloads.

Impact Analysis

If you run a vulnerable WeeChat server, an attacker with relay access could crash the entire chat service by sending a specially crafted WebSocket frame. This causes a denial of service, making the server unavailable until restarted.

Compliance Impact

This vulnerability could lead to denial-of-service (DoS) conditions by exhausting server memory, potentially disrupting service availability. For GDPR, this may impact data availability and integrity requirements. For HIPAA, it could affect the availability of critical systems handling protected health information.

Mitigation Strategies

Upgrade WeeChat to version 4.9.1 or later immediately. If upgrading is not possible, disable the relay module or the WebSocket protocol in WeeChat's configuration to prevent exploitation. Restrict access to the relay port via firewall rules to trusted IPs only.

Hi! I’m here to help you understand CVE-2026-53524. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70