UnrealIRCd labeled-response module allows command injection via label tag
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- None · High · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA.
Summary
The labeled-response module in UnrealIRCd 6.0.0 before 6.2.7.1 does not escape the IRCv3 "label" message tag when it echoes the tag into replies. Any user on a network with two or more linked servers can inject server-to-server commands that run with server authority. The weakness is classified as CWE-140 (Improper Neutralization of Delimiters), and CVSS 3.1 scores it 8.6 HIGH. CISA has not added it to KEV.
Written with Claude Haiku 5.5 from the sources below · 2026-11-08
Description from the CNA
The labeled-response module in UnrealIRCd 6.0.0 before 6.2.7.1 does not escape the IRCv3 "label" message tag when echoing it into replies, which allows any user on a network with two or more linked servers to inject server-to-server commands that are executed with server authority.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| UnrealIRCd | UnrealIRCd | before 6.2.7.1 | 6.2.7.1 | Patch available | CNA |
- UnrealIRCd VendorUnrealIRCd Affected before 6.2.7.1 Fixed in 6.2.7.1 Patch available CNA
Remediation
Upgrade UnrealIRCd to 6.2.7.1 or later, which fixes the issue.
Written with Claude Haiku 5.5 from the sources below · 2026-11-08
- Fix · CNA UnrealIRCd (UnrealIRCd) Fixed in 6.2.7.1
Timeline
- 2026-11-08 Threatist record created from CVE-2026-114713
- 2026-11-08 Alias added: GHSA-237f-p9h6-wq4r
References
More UnrealIRCd vulnerabilities
- TI-2010-01989 UnrealIRCd 3.2.8.1, as distributed on certain mirror sites from November 2009 through… CVSS 2.0HIGH 7.5
- TI-2026-61634 Resource allocation without limits in UnrealIRCd CVSS 4.0HIGH 8.7
- TI-2016-06143 The m_authenticate function in modules/m_sasl.c in UnrealIRCd before 3.2.10.7 and 4.x… CVSS 3.0HIGH 8.1
- TI-2023-27714 A buffer overflow in websockets in UnrealIRCd 6.1.0 through 6.1.3 before 6.1.4 allows an… CVSS 3.1HIGH 7.5
- TI-2009-04649 Buffer overflow in UnrealIRCd 3.2beta11 through 3.2.8, when allow::options::noident is… CVSS 2.0MEDIUM 6.8
- TI-2013-06048 UnrealIRCd 3.2.10 before 3.2.10.2 allows remote attackers to cause a denial of service… CVSS 2.0MEDIUM 5.0
Sources
- CVE-2026-114713 · CVE Program
- CVE-2026-114713 · NVD
- GHSA-237f-p9h6-wq4r · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences