CVE-2026-53524 describes a denial-of-service (DoS) vulnerability in the Relay WebSocket feature of Weechat. The issue arises from a decompression bomb attack, where specially crafted compressed data causes excessive resource consumption during decompression, leading to service disruption. The vulnerability requires network access and low privileges but no user interaction. The CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, indicating network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, no confidentiality or integrity impact, and high impact on availability.

Successful exploitation results in denial of service by exhausting resources during decompression of maliciously crafted data sent over the Relay WebSocket. This disrupts the availability of the Weechat service but does not affect confidentiality or integrity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the available data. Users should monitor vendor communications for updates and consider restricting access to the Relay WebSocket interface until a fix is available.