# WeeChat v4.10.1

- Product: WeeChat (https://whatsnew.fyi/product/weechat)
- Vendor: WeeChat
- Date: 2026-09-05
- Version: v4.10.1
- Original notes: https://github.com/weechat/weechat/releases/tag/v4.10.1
- Permalink: https://whatsnew.fyi/product/weechat/releases/v4.10.1
- Labels: Platforms: Desktop

What's New is an index, not a publisher: every entry below links to the vendor's own release notes, which are the authoritative source. Entries are labelled where they are hand-curated sample data, pre-releases, or drawn from a secondary source such as a developer blog.

Reuse: the summaries, labels and curation here are © What's New. Quote freely with attribution and a link back; wholesale republication of the corpus is not permitted — terms: https://whatsnew.fyi/terms. The vendors' own release notes remain their publishers'.

---

- **fixed** — Fix memory leak in SASL authentication with mechanism ecdsa-nist256p-challenge
- **fixed** — Reject an empty SASL challenge received with mechanism ecdsa-nist256p-challenge
- **security** — Limit size of data queued for sending to a client in relay to prevent memory exhaustion
- **security** — Reject fragmented, compressed or oversized websocket control frames received from a client in relay
- **security** — Limit size of partial message received from a client in relay to prevent memory exhaustion
- **security** — Reject script names containing path separators in the scripts repository file to prevent writing files outside the scripts directory
- **security** — Fix comparison of status in search of transfers to prevent a remote peer from starting a file transfer that was not accepted by the user
- **security** — Limit size of partial message received in DCC chat in xfer to prevent memory exhaustion
- **security** — Remove path from filename received in DCC file transfer in xfer to prevent writing the file outside the download directory

###### Fixed

- irc: fix memory leak in SASL authentication with mechanism "ecdsa-nist256p-challenge"
- irc: reject an empty SASL challenge received with mechanism "ecdsa-nist256p-challenge"

###### Security

- relay: limit size of data queued for sending to a client to prevent memory exhaustion ([#2357](https://github.com/weechat/weechat/issues/2357))
- relay: reject fragmented, compressed or oversized websocket control frames received from a client ([#2356](https://github.com/weechat/weechat/issues/2356))
- relay: limit size of partial message received from a client to prevent memory exhaustion ([#2347](https://github.com/weechat/weechat/issues/2347))
- script: reject script names containing path separators in the scripts repository file to prevent writing files outside the scripts directory ([#2351](https://github.com/weechat/weechat/issues/2351))
- xfer: fix comparison of status in search of transfers, preventing a remote peer from starting a file transfer that was not accepted by the user ([#2352](https://github.com/weechat/weechat/issues/2352))
- xfer: limit size of partial message received in DCC chat to prevent memory exhaustion ([#2349](https://github.com/weechat/weechat/issues/2349))
- xfer: remove path from filename received in DCC file transfer to prevent writing the file outside the download directory ([#2348](https://github.com/weechat/weechat/issues/2348))