CVE-2021-40516: Debian Linux

High severity, CVSS 7.5. EPSS: 1.6% chance of exploitation in the next 30 days.

WeeChat before 3.2.1 allows remote attackers to cause a denial of service (crash) via a crafted WebSocket frame that trigger an out-of-bounds read in plugins/relay/relay-websocket.c in the Relay plugin.

Affected products

• Debian Debian Linux: version 10.0 only
• Weechat Weechat: from 0.4.1, before 3.2.1 (fixed in 3.2.1)

Published 2021-09-05. Last modified 2026-06-17.