Description

WeeChat (Wee Enhanced Environment for Chat) is a free chat client. In versions 4.3.0 through 4.9.0, the WeeChat relay module's WebSocket permessage-deflate decompression function relay_websocket_inflate() has no upper bound on output size. An authenticated relay user can send a small compressed WebSocket frame (~100 bytes) that decompresses to gigabytes, exhausting all server memory and crashing the entire WeeChat process. The api protocol enables permessage-deflate and requires authentication before WebSocket upgrade. Version 4.9.1 patches the issue.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-21T23:16:26.213Z",
  "pubdate": "2026-08-21T23:16:26.213Z",
  "executiveSummary": "WeeChat (Wee Enhanced Environment for Chat) versions 4.3.0 through 4.9.0 contain a critical resource exhaustion vulnerability within its relay module's WebSocket permessage-deflate decompression function.\nThe flaw allows an authenticated relay user to trigger a classic decompression bomb scenario by sending maliciously crafted, highly compressed WebSocket frames that expand exponentially upon processing.\nSuccessful exploitation results in total exhaustion of available server memory, leading to an immediate crash and termination of the entire WeeChat process, thereby causing a complete denial of service.\nThe vulnerability stems from an absolute absence of upper bound constraints on the output size within the decompression routine.\nAttackers must possess valid authentication credentials for the relay module and interact over the network via the api protocol, which enables permessage-deflate and requires authentication prior to the WebSocket upgrade.\nThe associated risk implies severe availability degradation for affected chat infrastructure, requiring immediate remediation to maintain system stability and service continuity.",
  "technicalDetails": "The vulnerability resides in the WeeChat relay module, specifically within the WebSocket permessage-deflate decompression function designated as relay_websocket_inflate().\nThe affected versions include WeeChat 4.3.0 through 4.9.0.\nThe root cause of the vulnerability is the failure of the relay_websocket_inflate() function to enforce any upper bound or maximum size limits on the decompressed output generated from incoming WebSocket frames.\nNetwork exposure is defined by the relay module's api protocol, which enables the permessage-deflate extension and mandates authentication prior to the WebSocket upgrade handshake.\nDespite the requirement for prior authentication, the privilege requirements are low relative to the relay user role, granting standard authenticated relay users the capability to trigger the flaw.\nThe exploitation method relies on a decompression bomb payload mechanism.\nThe attack flow proceeds as follows: First, an authenticated attacker crafts a malicious WebSocket frame utilizing the permessage-deflate compression extension.\nSecond, the attacker transmits a relatively small compressed payload, approximately 100 bytes in size, over the network to the WeeChat relay server.\nThird, the WeeChat server receives the frame and passes it to the vulnerable relay_websocket_inflate() function for decompression.\nFourth, due to the lack of output size validation and resource bounding, the small input expands drastically during the inflation process, consuming gigabytes of memory as it decompresses into the server's RAM.\nFifth, the unchecked memory allocation rapidly exhausts all available system memory resources, triggering out-of-memory conditions or explicit allocation failures.\nFinally, the process crashes, resulting in the total termination of the WeeChat process and inducing a denial of service state for all connected clients.\nThe post-exploitation impact is strictly destructive regarding availability, terminating the chat daemon entirely without allowing remote code execution vectors described in the input."
}