CVE-2026-53524: 
Linux Debian vulnerability analysis and mitigation

CVE-2026-53524 is a Decompression Bomb (DoS) vulnerability in the WeeChat relay component's WebSocket permessage-deflate decompression function. An authenticated relay user can send a small compressed WebSocket frame (~100 bytes) that decompresses to gigabytes, exhausting all server memory and crashing the entire WeeChat process. It affects WeeChat versions 4.3.0 through 4.9.0, with version 4.9.1 containing the fix. The vulnerability carries a CVSS v3.1 base score of 6.5 (Medium), published May 31, 2026 (GitHub Advisory).

The root cause is CWE-409 (Improper Handling of Highly Compressed Data / Data Amplification) in the relay_websocket_inflate() function located in src/plugins/relay/relay-websocket.c (lines 552–589). The function initializes a destination buffer at 10× the compressed input size and doubles it (dest_size *= 2) on each iteration without any upper bound, allowing unbounded realloc() calls until memory is exhausted. The attack flow requires the attacker to first authenticate to the relay's api protocol (via HTTP Basic or Bearer credentials), then initiate a WebSocket upgrade with the Sec-WebSocket-Extensions: permessage-deflate header, and finally send a crafted binary frame containing a highly-compressible zlib stream (e.g., repeated null bytes). After approximately 30 doublings, the allocation exceeds available system memory, triggering an OOM kill of the WeeChat process (GitHub Advisory).

Successful exploitation results in a complete Denial of Service: the entire WeeChat process is killed by the OS OOM killer, terminating all IRC sessions, channels, and relay connections for the affected user. The attack requires only a single small compressed WebSocket frame and is repeatable on each restart of WeeChat. There is no confidentiality or integrity impact; the sole consequence is high availability loss (GitHub Advisory).

Exploitation requires valid relay credentials (password or TOTP+password), making this a low-privilege, network-accessible attack with low complexity. The vulnerability was verified against WeeChat v4.9.0. No public exploit code, exploit kits, or in-the-wild exploitation have been reported as of the available data. The CVE status was listed as "Reserved" at the time of Feedly ingestion, and no EPSS score or CISA KEV catalog entry is currently available (GitHub Advisory, Feedly).

1. Reconnaissance: Identify WeeChat instances with the relay plugin enabled and the api protocol configured, reachable over the network on the relay port.
2. Obtain credentials: Acquire valid relay credentials (password, or TOTP+password combination) through phishing, credential reuse, or other means.
3. Initiate WebSocket upgrade: Send an HTTP upgrade request to the relay endpoint including the Sec-WebSocket-Extensions: permessage-deflate header and valid Authorization credentials. The server validates auth and transitions to CONNECTED state.
4. Craft decompression bomb: Construct a small (~100 byte) masked WebSocket binary frame containing a zlib-compressed stream of highly-compressible data (e.g., a large sequence of repeated null bytes).
5. Send the frame: Transmit the crafted frame to the relay. The server's relay_websocket_inflate() function begins decompressing, doubling the output buffer approximately 30 times until available memory is exhausted.
6. OOM crash: The OS OOM killer terminates the WeeChat process, achieving denial of service. The attack can be repeated on each restart (GitHub Advisory).

• Logs: Sudden termination of the WeeChat process with no graceful shutdown message; OS-level OOM killer log entries (e.g., kernel: Out of memory: Kill process <pid> (weechat) in /var/log/syslog or dmesg).
• Network: WebSocket upgrade requests to the relay port containing the Sec-WebSocket-Extensions: permessage-deflate header followed immediately by a very small binary frame (≤200 bytes) from an authenticated client.
• Process: Rapid memory growth of the weechat process observable via top/htop shortly after a WebSocket connection is established; process disappears abruptly without user-initiated exit.

Upgrade WeeChat to version 4.9.1, which patches the unbounded decompression loop in relay_websocket_inflate() by enforcing an upper bound on decompressed output size (GitHub Advisory). As a workaround for those unable to upgrade immediately, disabling the api protocol in the relay configuration or restricting relay access to trusted IP addresses only will prevent exploitation. OpenSUSE security updates are also available for affected package versions (OpenSUSE Advisory).

The vulnerability was reported by researcher TristanInSec and published as a GitHub Security Advisory by the WeeChat maintainer (flashcode) on May 31, 2026. A FreeBSD VuXML entry and an OpenSUSE security announcement were subsequently published, indicating prompt uptake by downstream package maintainers (FreeBSD VuXML, OpenSUSE Advisory). No significant broader media coverage or notable social media discussion has been identified.