LiveActive security incident?Get immediate response
CVE Record

CVE-2021-40516: WeeChat before 3.2.1 allows remote attackers to cause a denial of service (crash) via a crafted WebSocket f...

WeeChat before 3.2.1 allows remote attackers to cause a denial of service (crash) via a crafted WebSocket frame that trigger an out-of-bounds read in plugins/relay/relay-websocket.c in the Relay plugin.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

CVE-2021-40516 is a crash bug in WeeChat before 3.2.1. A remote attacker could send a crafted WebSocket frame to the Relay plugin and cause a denial of service. The sources do not show data theft, code execution, or confirmed active exploitation.

Executive priority

Prioritize patching if WeeChat Relay is internet-facing or business-critical. For internal-only or unused Relay deployments, handle through normal vulnerability maintenance while confirming exposure. The main business risk is interruption of chat relay service, not confirmed compromise.

Technical view

The issue is an out-of-bounds read in plugins/relay/relay-websocket.c affecting WeeChat before 3.2.1. The trigger is a crafted WebSocket frame handled by the Relay plugin, with the documented impact limited to process crash denial of service.

Likely exposure

Exposure is most relevant where WeeChat's Relay plugin, especially WebSocket relay access, is enabled and reachable by untrusted networks. Systems not running WeeChat, not using Relay, or already updated to 3.2.1 or a distro-patched package are less likely exposed.

Exploitation context

The CVE record and references describe remote denial of service, but the bundle provides no evidence of public exploitation or CISA KEV listing. Treat this as a service availability risk rather than a confirmed active campaign.

Researcher notes

Available sources identify the vulnerable file, trigger class, and fixed upstream version, but do not provide CVSS, CWE, detailed affected CPEs, or exploitation telemetry. Avoid broader claims beyond remote crash denial of service in WeeChat Relay WebSocket handling.

Mitigation direction

  • Upgrade WeeChat to version 3.2.1 or later.
  • Apply the relevant distro security update, such as Debian DLA-2770-1 where applicable.
  • Review WeeChat vendor security guidance for environment-specific instructions.
  • Restrict Relay plugin WebSocket access to trusted networks where possible.
  • Monitor WeeChat relay services for unexpected crashes until patched.

Validation and detection

  • Inventory WeeChat installations and record package versions.
  • Confirm whether the Relay plugin and WebSocket relay access are enabled.
  • Check whether installed builds include the 3.2.1 fix or distro backport.
  • Review service logs for unexplained WeeChat crashes around relay activity.
  • Verify exposed relay endpoints are limited to intended trusted clients.
Prepared
Confidence
high
Sources
5

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2021-40516 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
0Timeline events
0ADP providers
4Source links

CVSS and timeline data

No CVSS vectors or timeline events were available in the normalized CVE source material.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
n/an/an/aListed
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.