[Git][security-tracker-team/security-tracker][master] Add four new weechat issues

[Salvatore Bonaccorso (@carnil)]

Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker


Commits:
cfd065bf by Salvatore Bonaccorso at 2026-11-02T18:07:00+01:00
Add four new weechat issues

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -129295,6 +129295,27 @@ CVE-2026-11391 (Tanium addressed a SQL injection vulnerability in Patch.)
 	NOT-FOR-US: Tanium
 CVE-2026-11351 (The ShinyStat Analytics WordPress plugin before 1.0.17 does not perfor ...)
 	NOT-FOR-US: WordPress plugin
+CVE-2026-XXXX [GHSA-h394-85x4-68c7: WeeChat relay HTTP request parser allows unauthenticated unbounded memory accumulation ]
+	- weechat <unfixed> (bug #1151101)
+	NOTE: https://github.com/weechat/weechat/security/advisories/GHSA-h394-85x4-68c7
+	NOTE: Fixed by: https://github.com/weechat/weechat/commit/5f7fec06d2d706f2897fba016180ef931346663b (v4.10.2)
+	NOTE: Fixed by: https://github.com/weechat/weechat/commit/87662578202bb3fff8a924a817ae8d8202626485 (v4.10.2)
+	NOTE: https://weechat.org/doc/weechat/security/#WSA-2026-24
+CVE-2026-XXXX [GHSA-q32h-5qvq-3936: WeeChat IRC inbound charset decoding heap buffer overflow in string_iconv]
+	- weechat <unfixed> (bug #1151101)
+	NOTE: https://github.com/weechat/weechat/security/advisories/GHSA-q32h-5qvq-3936
+	NOTE: Fixed by: https://github.com/weechat/weechat/commit/341f35fd5f52806742b4e148c6c8cc4d997a1310 (v4.10.2)
+	NOTE: https://weechat.org/doc/weechat/security/#WSA-2026-23
+CVE-2026-XXXX [GHSA-8wr2-x42m-7fxv: Heap buffer overflow in path of hdata sent to clients with "weechat" protocol]
+	- weechat <unfixed> (bug #1151101)
+	NOTE: https://github.com/weechat/weechat/security/advisories/GHSA-8wr2-x42m-7fxv
+	NOTE: Fixed by: https://github.com/weechat/weechat/commit/9fb7f87379d5a6aa275e25a0a48546a5a819495b (v4.10.2)
+	NOTE: https://weechat.org/doc/weechat/security/#WSA-2026-22
+CVE-2026-XXXX [GHSA-xj8h-x2w9-m8m6: Heap buffer overflow in nick prefixes after a reconnection]
+	- weechat <unfixed> (bug #1151101)
+	NOTE: https://github.com/weechat/weechat/security/advisories/GHSA-xj8h-x2w9-m8m6
+	NOTE: Fixed by: https://github.com/weechat/weechat/commit/ebd2849cdcff305153060840470e2acb1bfa645c (v4.10.2)
+	NOTE: https://weechat.org/doc/weechat/security/#WSA-2026-21
 CVE-2026-XXXX [GHSA-9xwq-39rj-59c9: Relay: missing size limit of data queued for sending to clients.]
 	- weechat <unfixed>
 	NOTE: https://github.com/weechat/weechat/security/advisories/GHSA-9xwq-39rj-59c9



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/cfd065bff706581bbed00842e7be5ba5f0bf445f

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/cfd065bff706581bbed00842e7be5ba5f0bf445f
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261102/0f3b6e88/attachment.htm>