Weechat

9 CVEs across 2 Weechat products. Browse Weechat vulnerabilities, severities, and proof-of-concept exploits.

Weechat products with known CVEs

ProductCVEs
Weechat9
Logger1
Weechat CVEs — newest first
CVESeverityScorePublishedSummary
CVE-2026-53525High7.42026-08-21WeeChat (Wee Enhanced Environment for Chat) is a free chat client. In versions 0.3.1 through 4.9.0, the WeeChat relay authentication uses non-constant-time str…
CVE-2026-53524Medium6.52026-08-21WeeChat (Wee Enhanced Environment for Chat) is a free chat client. In versions 4.3.0 through 4.9.0, the WeeChat relay module's WebSocket permessage-deflate dec…
CVE-2024-46613Critical9.82024-11-10WeeChat before 4.4.2 has an integer overflow and resultant buffer overflow at core/core-string.c when there are more than two billion items in a list. This aff…
CVE-2022-28352Medium4.32022-04-02WeeChat (aka Wee Enhanced Environment for Chat) 3.2 to 3.4 before 3.4.1 does not properly verify the TLS certificate of the server, after certain GnuTLS option…
CVE-2021-40516High7.52021-09-05WeeChat before 3.2.1 allows remote attackers to cause a denial of service (crash) via a crafted WebSocket frame that trigger an out-of-bounds read in plugins/r…
CVE-2020-9760Critical9.82020-03-23An issue was discovered in WeeChat before 2.7.1 (0.3.4 to 2.7 are affected). When a new IRC message 005 is received with longer nick prefixes, a buffer overflo…
CVE-2020-8955Critical9.82020-02-12irc_mode_channel_update in plugins/irc/irc-mode.c in WeeChat through 2.7 allows remote attackers to cause a denial of service (buffer overflow and application…
CVE-2017-14727High7.52017-09-23logger.c in the logger plugin in WeeChat before 1.9.1 allows a crash via strftime date/time specifiers, because a buffer is not initialized.
CVE-2017-8073High7.52017-04-23WeeChat before 1.7.1 allows a remote crash by sending a filename via DCC to the IRC plugin. This occurs in the irc_ctcp_dcc_filename_without_quotes function du…