CVE-2026-114713 with a CVSS score of 8.6 is a command injection vulnerability in the labeled-response module of the UnrealIRCd open-source IRC server. The flaw occurs because the module does not escape the IRCv3 label message tag when echoing it into replies, allowing extra lines to be inserted into those replies. An ordinary user can exploit this by injecting server-to-server commands through labeled-response replies, causing linked servers to execute them with server authority. The attack requires a network with two or more linked servers. Because the commands run with server or IRC operator authority, an attacker can perform privileged operations such as KILL and GLINE, disconnect users, ban them from the network, and execute other operator actions. This can undermine network integrity, availability, and administrative trust, potentially causing widespread disruption and unauthorized control of the IRC infrastructure.
We recommend you to update UnrealIRCd to version 6.2.7.1 or later.[/subscribe_to_unlock_form]
CVE-2026-114713 with a CVSS score of 8.6 is a command injection vulnerability in the labeled-response module of the UnrealIRCd open-source IRC server. The flaw occurs because the module does not escape the IRCv3 label message tag when echoing it into replies, allowing extra lines to be inserted into those replies. An ordinary user can exploit this by injecting server-to-server commands through labeled-response replies, causing linked servers to execute them with server authority. The attack requires a network with two or more linked servers. Because the commands run with server or IRC operator authority, an attacker can perform privileged operations such as KILL and GLINE, disconnect users, ban them from the network, and execute other operator actions. This can undermine network integrity, availability, and administrative trust, potentially causing widespread disruption and unauthorized control of the IRC infrastructure.
We recommend you to update UnrealIRCd to version 6.2.7.1 or later.[emaillocker id="1283"]
The following reports contain further technical details:
[/emaillocker]