UnrealIRCd label tag injection: any user can run commands with server/IRCOp authority (CVE-2026-114713)
Severity: critical · Patch status: patched · Since 2026-11-07 · CVE-2026-114713
On 7 November 2026 UnrealIRCd shipped 6.2.7.1 and a hot-patch bundle (bundle-20261107) that fix nine security issues. The maintainer says they were found in an internal audit done with the help of AI. The critical one, CVE-2026-114713, is an escaping failure in the labeled-response module's handling of the IRCv3 "label" message tag. Any user can inject newlines into server-to-server traffic, and the receiving servers execute the injected IRC commands with server authority, such as KILL or GLINE. NVD records the affected range as UnrealIRCd 6.0.0 before 6.2.7.1 and says the flaw needs a network with two or more linked servers. The other eight issues cover IP-address leaks that let a user decloak another user, crashes, a hang, a connection-counting error that can refuse every new connection until restart, a TLS renegotiation flood, and a Services ban limit. NVD lists no CVE for those eight. The vendor advisory reports no exploitation. This research found no CISA KEV entry, no public proof of concept, and no EPSS score yet. Apply the SPAMFILTER workaround first, which only protects if every server runs 6.0.4 or newer. Then hot-patch with bundle-20261107 or upgrade to 6.2.7.1 and restart. UnrealIRCd 5 (EOL) is also affected; the vendor's mitigation there is a blacklist-module line and a restart.
What to do
- Before anything else, run as an IRCOp on the network: SPAMFILTER add -regex T block - Invalid_label ^label=(?![^\r\n;\x20]*\z) . This protects all linked servers only if every server runs 6.0.4 or newer. It does not fix the other eight issues.
- Hot-patch each *NIX server (UnrealIRCd 6.0.0 to 6.2.7, no restart): ./unrealircd hot-patch bundle-20261107 . The output should end with "Patch installed and server rehashed correctly. All should be good now!"
- Verify: ./unrealircd module-status | grep labeled-response should show 5.0-hot-patch-bundle-20261107, or 6.2.7.1 if the server was upgraded. On IRC, MODULE -all as an IRCOp, then search for labeled-response. If the hot-patch fails, use the FAQ section "Hot-patching failed" or upgrade.
- Alternatively upgrade to 6.2.7.1 (./unrealircd upgrade on *NIX, or download the release on Windows) and restart the server. Windows servers must upgrade.
- UnrealIRCd 5 (EOL, affected): add blacklist-module "labeled-response"; to the config on every server and restart (not rehash). The vendor advises moving to UnrealIRCd 6.
- UnrealIRCd 3.2.x and 4 (EOL): the vendor has not checked them and says it is likely that several fixed bugs go back to 3.2.x. Treat them as unassessed and move to UnrealIRCd 6.
Fixed versions
- 6.2.7.1
- hot-patch bundle-20261107
Sources
All live incidents on Threat Watch
