CVE-2026-53524

CVE-2026-53524 is a memory exhaustion vulnerability in WeeChat's WebSocket relay decompression path. A compressed payload of just a few hundred bytes can decompress to gigabytes, causing the entire WeeChat process to crash and taking every IRC connection, DM, and buffer with it. The CVSS 6.5 score badly understates the real impact in production environments. The root cause is not a developer forgetting bounds checking — it's a trust model failure. The WebSocket relay requires authentication before the upgrade, creating a false assumption that authenticated users are trusted and their data doesn't need resource consumption limits. This is the inversion: authentication removed the security constraint that would have been obvious for untrusted input. The decompression function likely works correctly for legitimate compressed data; it simply lacks the defensive upper bound that specialized knowledge of compression attacks would demand. This pattern recurs across software because the WebSocket permessage-deflate specification provides no guidance on receiver-side memory limits, leaving implementers to invent constraints that aren't obvious unless you've specifically studied decompression bombs. The knowledge exists — zip bombs, XML bombs, bzip2 variants have been documented for decades — but it never formalizes as a universal implementation requirement. Each new protocol re-implements the same vulnerability. The blast radius is worse than the CVE suggests. An "authenticated relay user" in WeeChat isn't necessarily a trusted human — it can be a compromised bouncer, a malicious IRC server, or a relay you set up on another machine. The auth gate doesn't segment damage; one authenticated connection can exhaust the entire process that multiplexes all your other connections. WeeChat runs on small VPS instances where memory exhaustion has immediate visible consequences, making this more severe in practice than the scoring reflects. You should verify your WeeChat version: 4.3.0 through 4.9.0 are affected, and 4.9.1 contains the fix. If you're running the relay module on resource-constrained infrastructure, treat this as a high-priority patch regardless of the CVSS score. The fix should include an explicit output size cap on the decompression function, but also consider whether your relay architecture assumes authenticated peers are non-adversarial — that's the deeper threat model failure to examine.

Reviewed through automated stages and approved by a human before publication.