WeeChat — CWE-407 Disclosure Brief

2026-03-27 · Patch available — awaiting upstream merge

Finding

Two O(n²) defects in WeeChat's IRC plugin. Both involve irc_nick_search() — a linear list walk — called in high-frequency IRC protocol handlers. One fires on every AWAY/NICK/QUIT/KILL event; the other fires during NAMES/353 channel member deduplication. Measured at 8,000× and 4,000× respectively. Patches ready for upstream review.

The Defects

weechat-0001 (PATCHED — HIGH): irc-protocol.c

/* irc_nick_search() — O(N) linked list walk */
/* Called in AWAY/NICK/QUIT/KILL handlers per event: */
struct t_irc_nick *nick = irc_nick_search(server, channel, nick_name);
/* O(C×N) per event — C channels × N nicks per channel */

irc_nick_search() walks the nick list linearly for every nick-related IRC event. For C channels and N nicks per channel: O(C × N) per event. Measured ratio: 8,000×.

weechat-0002 (PATCHED — HIGH): irc-nick.c:612

/* Inside NAMES/353 handler — per nick in channel listing: */
struct t_irc_nick *existing = irc_nick_search(server, channel, nick_name);
/* O(N²) large channels during JOIN */

irc_nick_search() called per nick during NAMES deduplication. For N nicks in a channel: O(N²) total during channel join. Measured ratio: 4,000×.

Complexity Proof

weechat-0001: For C=100 channels, N=80 nicks per channel:

Per QUIT event: O(C×N) = 8,000 comparisons
Fixed: GHashTable nick→struct per channel → O(C) per event
8,000× measured ratio.

weechat-0002: For N=4000 nicks in a large IRC channel:

NAMES dedup: O(N²) = 16M comparisons
Fixed: GHashTable → O(N)
4,000× measured ratio.

Impact

All WeeChat users on busy IRC networks. Large channels (Libera.Chat, IRCnet, OFTC) with thousands of members hit weechat-0002 on every JOIN. High-traffic servers with many channels hit weechat-0001 on every QUIT/NICK event. WeeChat is the most popular terminal IRC client; these defects cause visible lag on IRC networks.

The Fix

Replace irc_nick_search() linked-list walk with a GHashTable per channel:

/* Before */
struct t_irc_nick *nick = irc_nick_search(server, channel, nick_name);
/* O(N) linear list walk */

/* After */
/* CWE-407 fix: GHashTable nick_by_name per channel for O(1) lookup. */
struct t_irc_nick *nick = g_hash_table_lookup(channel->nicks_by_name, nick_name);

Patch

defects/weechat/patch/weechat-0001-0002-irc-nick-hashtable.patch

What We Ask

Confirm receipt and assign a GitHub Security Advisory or issue reference.
Validate the patch against your IRC protocol handler test suite.
Assess CVE eligibility — weechat-0001 measured at 8,000× on busy IRC networks.
Coordinate a disclosure date — we are targeting 90 days from first contact.

Contact: see cover email. This brief is confidential until coordinated disclosure.

2.9 KiB Raw Blame History Unescape Escape