debian/weechat vulnerabilities

Latest debian/weechat CVEs

Newest publication first

1. CVE-2026-53525 WeeChat has Non-Constant-Time Password Hash Comparison in Relay Authentication

   Published 2026-08-21

   High·CVSS 7.4 EPSS 0.43%

   WeeChat (Wee Enhanced Environment for Chat) is a free chat client. In versions 0.3.1 through 4.9.0, the WeeChat relay authentication uses non-constant-time string comparison functions (weechat_strcasecmp and strcmp) to verify password hashes and plaintext passwords. An attacker c...

2. CVE-2026-53524 WeeChat has a Decompression Bomb in Relay WebSocket (DoS)

   Published 2026-08-21

   Medium·CVSS 6.5 EPSS 0.48%

   WeeChat (Wee Enhanced Environment for Chat) is a free chat client. In versions 4.3.0 through 4.9.0, the WeeChat relay module's WebSocket permessage-deflate decompression function relay_websocket_inflate() has no upper bound on output size. An authenticated relay user can send a s...

3. CVE-2024-46613 WeeChat before 4.4.2 has an integer overflow and resultant buffer overflow at core/core-string.c when there are more than two billion items in a list. This affects string_free_split_shared , string_fr...

   Published 2024-11-10

   Critical·CVSS 9.8 EPSS 0.48%

   WeeChat before 4.4.2 has an integer overflow and resultant buffer overflow at core/core-string.c when there are more than two billion items in a list. This affects string_free_split_shared , string_free_split, string_free_split_command, and string_free_split_tags.

4. CVE-2022-28352 WeeChat (aka Wee Enhanced Environment for Chat) 3.2 to 3.4 before 3.4.1 does not properly verify the TLS certificate of the server, after certain GnuTLS options are changed, which allows man-in-the-mi...

   Published 2022-04-02

   Medium·CVSS 4.8 EPSS 0.43%

   WeeChat (aka Wee Enhanced Environment for Chat) 3.2 to 3.4 before 3.4.1 does not properly verify the TLS certificate of the server, after certain GnuTLS options are changed, which allows man-in-the-middle attackers to spoof a TLS chat server via an arbitrary certificate. NOTE: th...

5. DLA-2770-1 weechat - security update

   Published 2021-09-30

   Unknown

6. CVE-2021-40516 WeeChat before 3.2.1 allows remote attackers to cause a denial of service (crash) via a crafted WebSocket frame that trigger an out-of-bounds read in plugins/relay/relay-websocket.c in the Relay plugi...

   Published 2021-09-05

   High·CVSS 7.5 EPSS 1.6%

   WeeChat before 3.2.1 allows remote attackers to cause a denial of service (crash) via a crafted WebSocket frame that trigger an out-of-bounds read in plugins/relay/relay-websocket.c in the Relay plugin.

7. DLA-2157-1 weechat - security update

   Published 2020-03-24

   Unknown

8. CVE-2020-9760 An issue was discovered in WeeChat before 2.7.1 (0.3.4 to 2.7 are affected). When a new IRC message 005 is received with longer nick prefixes, a buffer overflow and possibly a crash can happen when a....

   Published 2020-03-23

   Critical·CVSS 9.8 EPSS 2.1%

   An issue was discovered in WeeChat before 2.7.1 (0.3.4 to 2.7 are affected). When a new IRC message 005 is received with longer nick prefixes, a buffer overflow and possibly a crash can happen when a new mode is set for a nick.

9. CVE-2020-9759 webOS TV Emulator privilege escalation vulnerability

   Published 2020-03-23

   High·CVSS 7.8 EPSS 0.47%

   A Vulnerability of LG Electronic web OS TV Emulator could allow an attacker to escalate privileges and overwrite certain files. This vulnerability is due to wrong environment setting. An attacker could exploit this vulnerability through crafted configuration files and executable...

10. CVE-2020-8955 irc_mode_channel_update in plugins/irc/irc-mode.c in WeeChat through 2.7 allows remote attackers to cause a denial of service (buffer overflow and application crash) or possibly have unspecified other...

    Published 2020-02-12

    Critical·CVSS 9.8 EPSS 3.4%

    irc_mode_channel_update in plugins/irc/irc-mode.c in WeeChat through 2.7 allows remote attackers to cause a denial of service (buffer overflow and application crash) or possibly have unspecified other impact via a malformed IRC message 324 (channel mode).

11. DLA-1111-1 weechat - security update

    Published 2017-09-26

    Unknown

12. CVE-2017-14727 logger.c in the logger plugin in WeeChat before 1.9.1 allows a crash via strftime date/time specifiers, because a buffer is not initialized.

    Published 2017-09-23

    High·CVSS 7.5 EPSS 2.8%

    logger.c in the logger plugin in WeeChat before 1.9.1 allows a crash via strftime date/time specifiers, because a buffer is not initialized.

13. DSA-3836-1 weechat - security update

    Published 2017-04-27

    Unknown

14. DLA-919-1 weechat - security update

    Published 2017-04-26

    Unknown

15. CVE-2017-8073 WeeChat before 1.7.1 allows a remote crash by sending a filename via DCC to the IRC plugin. This occurs in the irc_ctcp_dcc_filename_without_quotes function during quote removal, with a buffer overflo...

    Published 2017-04-23

    High·CVSS 7.5 EPSS 3.1%

    WeeChat before 1.7.1 allows a remote crash by sending a filename via DCC to the IRC plugin. This occurs in the irc_ctcp_dcc_filename_without_quotes function during quote removal, with a buffer overflow.

16. DSA-2598-1 weechat - several

    Published 2013-01-04

    Unknown

17. CVE-2012-5534 The hook_process function in the plugin API for WeeChat 0.3.0 through 0.3.9.1 allows remote attackers to execute arbitrary commands via shell metacharacters in a command from a plugin, related to "she...

    Published 2012-12-03

    High·CVSS 7.5 EPSS 4.4%

    The hook_process function in the plugin API for WeeChat 0.3.0 through 0.3.9.1 allows remote attackers to execute arbitrary commands via shell metacharacters in a command from a plugin, related to "shell expansion."

18. CVE-2012-5854 Heap-based buffer overflow in WeeChat 0.3.6 through 0.3.9 allows remote attackers to cause a denial of service (crash or hang) and possibly execute arbitrary code via crafted IRC colors that are not p...

    Published 2012-11-19

    High·CVSS 7.5 EPSS 5.5%

    Heap-based buffer overflow in WeeChat 0.3.6 through 0.3.9 allows remote attackers to cause a denial of service (crash or hang) and possibly execute arbitrary code via crafted IRC colors that are not properly decoded.

19. CVE-2011-1428 Wee Enhanced Environment for Chat (aka WeeChat) 0.3.4 and earlier does not properly verify that the server hostname matches the domain name of the subject of an X.509 certificate, which allows man-in-...

    Published 2011-03-16

    Medium·CVSS 5.8 EPSS 1.1%

    Wee Enhanced Environment for Chat (aka WeeChat) 0.3.4 and earlier does not properly verify that the server hostname matches the domain name of the subject of an X.509 certificate, which allows man-in-the-middle attackers to spoof an SSL chat server via an arbitrary certificate, r...

20. CVE-2009-0661 Wee Enhanced Environment for Chat (WeeChat) 0.2.6 allows remote attackers to cause a denial of service (crash) via an IRC PRIVMSG command containing crafted color codes that trigger an out-of-bounds r...

    Published 2009-03-19

    Medium·CVSS 5.0 EPSS 3.1%

    Wee Enhanced Environment for Chat (WeeChat) 0.2.6 allows remote attackers to cause a denial of service (crash) via an IRC PRIVMSG command containing crafted color codes that trigger an out-of-bounds read.

21. DSA-1744-1 weechat - denial of service

    Published 2009-03-18

    Unknown

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.