CVE-2026-53525
Fixed in a distro release EPSS <1%CVSS 7.4
WeeChat (Wee Enhanced Environment for Chat) is a free chat client. In versions 0.3.1 through 4.9.0, the WeeChat relay authentication uses non-constant-time string comparison functions (weechat_strcasecmp and strcmp) to verify password hashes and plaintext passwords. An attacker can exploit timing differences to extract the server-computed hash character by character, then authenticate using the correct hash without knowing the password. Version 4.9.1 fixes the issue.
Products: weechat
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian:12 | weechat | no fix |
| Debian:13 | weechat | no fix |
| Debian:14 | weechat | 4.9.3-1 |
| Ubuntu:22.04:LTS | weechat | no fix |
| Ubuntu:24.04:LTS | weechat | no fix |
| Ubuntu:26.04:LTS | weechat | no fix |
| Ubuntu:Pro:16.04:LTS | weechat | no fix |
| Ubuntu:Pro:18.04:LTS | weechat | no fix |
| Ubuntu:Pro:20.04:LTS | weechat | no fix |
| openSUSE:Leap 16.0 | weechat | 4.10.0-bp160.1.1 |
| openSUSE:Tumbleweed | weechat | 4.10.0-1.1 |