Weechat

v4.9.2 Security

This release includes 7 security fixes for security teams reviewing exposed deployments.

Published 1mo Editors & IDEs

View tool

✓ No known CVEs patched

Read the diff → Tool health → What is this tool? →

This release patches 7 known CVEs

Topics

c chat client extensible irc javascript

+8 more

lua perl php python ruby scheme scripting tcl

Affected surfaces

rce_ssrf breaking_upgrade

ReleasePort's take

Moderate signal

editorial:auto 1mo

Version v4.9.2 of Weechat resolves multiple critical security issues and a bug causing an infinite loop in string_replace when the search string is empty.

Why it matters: Addresses six high‑severity (90) vulnerabilities that could cause memory exhaustion or out‑of‑bounds reads, plus fixes an infinite‑loop defect; upgrade immediately to mitigate risk.

Summary

AI summary

Fixes multiple critical bugs including memory‑exhaustion limits for irc, relay and a path‑traversal issue in xfer.

Changes in this release

Type	Severity	Summary	CVE
Security
Security	Critical	Limits size of data received from IRC server to prevent memory exhaustion Limits size of data received from IRC server to prevent memory exhaustion Source: llm_adapter@2026-06-07 Confidence: high	—
Security	Critical	Fixes out-of-bounds read on incoming DCC command with quoted filename ending message Fixes out-of-bounds read on incoming DCC command with quoted filename ending message Source: llm_adapter@2026-06-07 Confidence: high	—
Security	Critical	Limits size of received websocket frame and HTTP body in relay to prevent memory exhaustion Limits size of received websocket frame and HTTP body in relay to prevent memory exhaustion Source: llm_adapter@2026-06-07 Confidence: high	—
Security	Critical	Limits size of partial message while reading HTTP request in relay to prevent memory exhaustion Limits size of partial message while reading HTTP request in relay to prevent memory exhaustion Source: llm_adapter@2026-06-07 Confidence: high	—
Security	Critical	Fixes out-of-bounds read in dump of data in relay (#2324) Fixes out-of-bounds read in dump of data in relay (#2324) Source: llm_adapter@2026-06-07 Confidence: high	—
Security	Critical	Replaces directory separator in remote nick by underscore to prevent writing file outside download directory Replaces directory separator in remote nick by underscore to prevent writing file outside download directory Source: llm_adapter@2026-06-07 Confidence: high	—
Security	Critical	Fixes out-of-bounds read when receiving empty line in DCC chat Fixes out-of-bounds read when receiving empty line in DCC chat Source: llm_adapter@2026-06-07 Confidence: high	—
Bugfix	High	Fixes infinite loop in string_replace when search string is empty Fixes infinite loop in string_replace when search string is empty Source: llm_adapter@2026-06-07 Confidence: high	—

Full changelog

Fixed

api: fix infinite loop in function string_replace when the search string is empty
irc: limit size of data received from the server to prevent memory exhaustion
irc: fix out-of-bounds read on incoming DCC command with a quoted filename ending the message (#2322)
relay: limit size of received websocket frame and HTTP body to prevent memory exhaustion
relay: limit size of partial message received while reading an HTTP request to prevent memory exhaustion
relay: fix out-of-bounds read in dump of data (#2324)
xfer: replace directory separator in remote nick by underscore in download filename to prevent writing the file outside the download directory (#2321)
xfer: fix out-of-bounds read when receiving empty line in DCC chat (#2323)

Download

https://weechat.org/download/weechat/4.9.2/

Security Fixes

Limit size of data received from IRC server to prevent memory exhaustion
Fix out‑of‑bounds read on incoming DCC command with quoted filename ending the message (IRC)
Limit size of websocket frame and HTTP body in relay to prevent memory exhaustion
Limit size of partial message while reading HTTP request in relay to prevent memory exhaustion
Fix out‑of‑bounds read in relay data dump (#2324)
Replace directory separator in remote nick by underscore in xfer download filename to prevent writing outside the download directory (path traversal) (#2321)
Fix out‑of‑bounds read when receiving empty line in DCC chat (xfer) (#2323)

View diff on GitHub

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Share on X Share on Bluesky

Track Weechat

Get notified when new releases ship.

About Weechat

Fast, light and extensible chat client.

All releases →