The vulnerability resides in WeeChat’s relay module, where the WebSocket permessage-deflate decompression routine has no limit on the size of the uncompressed data. An attacker who can authenticate to the relay (the protocol requires authentication before the WebSocket upgrade) can send a tiny compressed frame that expands to gigabytes, exhausting the process’s memory and forcing the WeeChat client to terminate. This results in a denial of service for all users connected to the relay. The weakness is a classic example of uncontrolled resource consumption, classified as CWE-409.

WeeChat version 4.3.0 through 4.9.0 is affected. The authenticated relay user can trigger the issue by sending a compressed WebSocket frame. Version 4.9.1 contains the fix, and should be used as the remediation baseline.

The CVSS score of 6.5 indicates moderate severity, but the lack of an EPSS value means the exploitation probability cannot be quantified. The vulnerability is not listed in the CISA KEV catalog, suggesting no known public exploitation. The attack vector is local to any authenticated relay user; an unprivileged user who can gain relay access can trigger the DoS. The risk to an organization is a potential service disruption, especially for systems that rely on the relay for critical chat or command interfaces. The exploit is straightforward to carry out once authentication is achieved, but requires that the attacker can bind to the relay port. Mitigation by upgrading to 4.9.1 or disabling the vulnerable feature lowers the risk to minimal.