WeeChat 4.9.5: this time the bugs are not just in the relay
Updated August 9, 2026
WeeChat released 4.9.5 on 26 July, one week after 4.9.4. Three more advisories, and the important difference is who they reach.
The 4.9.4 round was a relay story — serious, but only if you ran a relay. This round is not:
- Use-after-free in the IRC plugin (high) — triggered when a batched message causes a disconnection from the server. Affects 4.0.0 through 4.9.4. GHSA-rfmh-3r7f-jpx5
- Stack buffer overflow (medium) in
irc_message_split_join, when building a JOIN with a large list of channels and keys. Affects 0.3.6 through 4.9.4 — which is to say, essentially every WeeChat anyone is running. GHSA-q2xg-9ggx-77mr - Use-after-free and double free in the relay (high) — when a remote relay sends an event with an array as the body. Affects 4.3.0 through 4.9.4. GHSA-hx59-4hq9-6vmw
The first one is the one to think about. Batches are ordinary IRCv3 traffic that servers send unprompted, so the trigger is not something you do — it is something the network does to you. "I don't run a relay" was a valid reason to relax two weeks ago. It is not now.
Worth keeping in perspective: these are memory-safety bugs, not a demonstrated remote shell, and no CVEs were assigned. But a malicious or compromised server is exactly the threat model a chat client should survive, and this is the second security release in eight days.
Update: your package manager, or weechat.org/download. Anything at 4.9.5 or later has the fixes — including 4.10.0, which shipped a week after this.