CVE-2026-53524: WeeChat Relay DoS Vulnerability

CVE-2026-53524 Overview

CVE-2026-53524 is a resource exhaustion vulnerability in WeeChat (Wee Enhanced Environment for Chat), a free chat client. The flaw affects the relay module's WebSocket permessage-deflate decompression function relay_websocket_inflate() in versions 4.3.0 through 4.9.0. The function enforces no upper bound on decompressed output size. An authenticated relay user can send a small compressed WebSocket frame of roughly 100 bytes that decompresses to gigabytes. This exhausts server memory and crashes the entire WeeChat process. Version 4.9.1 patches the issue.

Critical Impact
An authenticated relay user can crash the WeeChat process with a single ~100-byte compressed WebSocket frame that expands to gigabytes in memory.

Affected Products

WeeChat 4.3.0 through 4.9.0 (relay module with api protocol)
WeeChat WebSocket permessage-deflate implementation
WeeChat 4.9.1 contains the fix

Discovery Timeline

2026-08-21 - CVE-2026-53524 published to NVD
2026-08-24 - Last updated in NVD database

Technical Details for CVE-2026-53524

Vulnerability Analysis

WeeChat's relay module exposes a WebSocket interface that supports the permessage-deflate extension for message compression. The api protocol enables this extension by default and requires authentication before the WebSocket upgrade completes. Once authenticated, a client can send compressed frames that WeeChat inflates using relay_websocket_inflate().

The function decompresses incoming frames without capping output size or streaming the result. Highly compressible input, such as a long run of zero bytes, expands by several orders of magnitude. A frame near 100 bytes can inflate to multiple gigabytes, consuming all available memory. The WeeChat process then terminates, disconnecting every user relying on that relay. This class of flaw is tracked as CWE-409: Improper Handling of Highly Compressed Data (Data Amplification).

Root Cause

The relay_websocket_inflate() function does not enforce a maximum decompressed length. The inflate loop grows its output buffer until decompression completes or the process runs out of memory. Because the ratio between compressed and decompressed sizes is attacker-controlled, a small frame can force unbounded allocation.

Attack Vector

An attacker first authenticates to the relay, which is a low-privilege requirement rather than a barrier for insider threats or environments with shared credentials. The attacker then negotiates permessage-deflate during the WebSocket handshake and sends a crafted compressed frame. The server inflates the payload, consumes available memory, and crashes. Refer to the WeeChat security advisory GHSA-v2v4-45wm-5cr3 for full technical details.

Detection Methods for CVE-2026-53524

Indicators of Compromise

Sudden WeeChat process termination shortly after a relay client connects and completes authentication.
Rapid memory growth of the weechat process correlated with active WebSocket relay sessions.
Relay logs showing successful authentication followed by immediate disconnection of all clients.
Kernel out-of-memory (OOM) killer entries in dmesg or journalctl naming the WeeChat process.

Detection Strategies

Monitor resident set size (RSS) of the WeeChat process and alert on sharp increases beyond baseline.
Inspect relay traffic for WebSocket frames using permessage-deflate with unusually high compression ratios.
Correlate authentication events in WeeChat relay logs with process crash or restart events.

Monitoring Recommendations

Ingest WeeChat relay logs and host memory metrics into a centralized analytics platform for correlation.
Track process restart frequency for WeeChat instances and treat repeated crashes as a high-priority signal.
Alert on OOM-killer events targeting chat or relay services on hosts running WeeChat.

How to Mitigate CVE-2026-53524

Immediate Actions Required

Upgrade WeeChat to version 4.9.1 or later on all hosts running the relay module.
Audit relay user accounts and rotate credentials for accounts that may be shared or overly privileged.
Restrict network exposure of the relay port to trusted networks or VPN clients only.

Patch Information

WeeChat 4.9.1 patches relay_websocket_inflate() to bound decompressed output. Administrators should update through their distribution package manager or by rebuilding from the upstream release. Details are documented in the GitHub Security Advisory GHSA-v2v4-45wm-5cr3.

Workarounds

Disable the api relay protocol until the WeeChat upgrade is applied.
Disable permessage-deflate negotiation on the relay if the deployment permits it.
Limit relay access with firewall rules so only known client addresses can reach the WebSocket endpoint.
Apply per-process memory limits using systemdMemoryMax= or ulimit to contain the impact of a crash.

bash

# Example systemd override to cap WeeChat memory usage
# /etc/systemd/system/weechat.service.d/memory.conf
[Service]
MemoryMax=1G
MemoryHigh=768M