The Weechat project reports:
- core: fix buffer overflow in display of time in chat area with a custom time format
- core: fix integer overflow in size calculation when evaluating "${hide:...}" and "${base_encode:...}"
- core: fix possible buffer overflow in command /color alias
- core: fix possible buffer overflow in list of commands displayed by /help
- irc: fix heap use-after-free when a batched message causes a disconnection from the server (GHSA-rfmh-3r7f-jpx5)
- irc: fix stack buffer overflow when splitting a JOIN message with a large list of channels and keys (GHSA-q2xg-9ggx-77mr)
- irc: limit size of data received from the server to prevent memory exhaustion
- irc: fix out-of-bounds read on incoming DCC command with a quoted filename ending the message
- logger: fix path traversal in log file name when a buffer local variable contains the char used internally to protect directory separators
- relay: fix use-after-free and double free on remote buffer (GHSA-hx59-4hq9-6vmw)
- relay: fix authentication bypass with the "plain" password hash algorithm (GHSA-68ff-gq39-pqjm)
- relay: limit size of decompressed websocket frame with permessage-deflate to prevent memory exhaustion (GHSA-v2v4-45wm-5cr3, CVE-2026-53524)
- relay: limit size of received websocket frame and HTTP body to prevent memory exhaustion
- relay: limit size of partial message received while reading an HTTP request to prevent memory exhaustion
- relay: fix timing attack on password authentication (GHSA-vhv8-g2r9-cwcc, CVE-2026-53525)
- relay: fix out-of-bounds read in dump of data
- relay/api: fix memory leak in resources "handshake", "input" and "completion" (GHSA-wmpc-m6g9-fwj8)
- relay: fix read of uncompressed websocket frame
- api, relay: fix timing attack on TOTP validation (GHSA-vhv8-g2r9-cwcc, CVE-2026-53525)
- xfer: replace directory separator in remote nick by underscore in download filename to prevent writing the file outside the download directory
- xfer: fix out-of-bounds read when receiving empty line in DCC chat
- xfer: fix out-of-bounds write in xfer file transfer resume