Security update for weechat

The WeeChat update to versions 4.9.4, 4.9.5, and 4.10.0 fixes numerous security vulnerabilities. These include buffer overflows in chat time display and command aliasing, integer overflow in size calculations, heap use-after-free on IRC disconnection, stack buffer overflow in JOIN message parsing, path traversal in log file naming, authentication bypass via the "plain" password hash algorithm, timing attacks on password and TOTP authentication, and memory exhaustion via large websocket frames and HTTP bodies. Additional fixes address out-of-bounds reads and writes in various components. The update also improves performance and adds theming features. Several CVEs are addressed, including CVE-2026-53524 and CVE-2026-53525.

Exploitation of these vulnerabilities could lead to memory corruption, denial of service through memory exhaustion, authentication bypass, information disclosure via timing attacks, and potential arbitrary code execution due to buffer overflows and use-after-free conditions. The relay component is particularly affected by memory exhaustion and authentication bypass issues, which could impact the security of remote connections. The fixes mitigate these risks by correcting the underlying code flaws.

A security update is available that fixes all identified vulnerabilities. Users should upgrade to WeeChat version 4.10.0 or later to apply these fixes. No additional mitigations are indicated beyond applying the official update.