UnrealIRCd before 6.2.7.1: any normal user can run commands with server/IRCOp authority (critical CVE-2026-114713) plus 8 more fixes ยท updates https://pwn.watch/i/unrealircd-6-2-7-1-labeled-response-ircop-command-cve-2026-114713 UnrealIRCd released 6.2.7.1 and a no-restart hot-patch (bundle-20261107) on Nov 7 2026 fixing 9 security issues found in an AI-assisted internal audit. The critical one, CVE-2026-114713, is in the labeled-response module, which does not escape the IRCv3 "label" message tag when echoing it into replies; on a network with two or more linked servers any ordinary user can inject server-to-server commands that run with server or IRCOp authority (KILL, GLINE and more). Maintainer Syzop calls it the most critical issue found in UnrealIRCd in the past 15 years. The other 8 fixes cover two IP-address leaks (including "decloaking" another user), a blacklist-recheck hang, a user-triggerable crash on CHGIDENT from Services, a counting error that can lock out all new connections with "This server is full", no cap on how many bans Services can set (now 2x set::maxbans), a TLS renegotiation flood issue and a possible whowasdb crash. UnrealIRCd 5 (end of life since 2023) is also affected by the critical bug. Apply the SPAMFILTER workaround first, then hot-patch or upgrade. en Sun, 08 Nov 2026 00:00:00 GMT UnrealIRCd before 6.2.7.1: any normal user can run commands with server/IRCOp authority (critical CVE-2026-114713) plus 8 more fixes: MITRE publishes CVE-2026-114713 (CVSS 3.1 8.6): the labeled-response module does not escape the IRCv3 label tag, letting any user on a network with two or more linked servers inject server-to-server commands executed with server authority. https://pwn.watch/i/unrealircd-6-2-7-1-labeled-response-ircop-command-cve-2026-114713 https://pwn.watch/i/unrealircd-6-2-7-1-labeled-response-ircop-command-cve-2026-114713#2026-11-08-7958c8b9 Sun, 08 Nov 2026 00:00:00 GMT critical <p><a href="https://www.cve.org/CVERecord?id=CVE-2026-114713">Source</a></p> UnrealIRCd before 6.2.7.1: any normal user can run commands with server/IRCOp authority (critical CVE-2026-114713) plus 8 more fixes: UnrealIRCd releases 6.2.7.1 and hot-patch bundle-20261107 fixing 9 security issues, including critical CVE-2026-114713 (normal users can execute commands with server/IRCOp authority), and publishes a SPAMFILTER workaround that protects networks whose servers are all on 6.0.4 or newer. https://pwn.watch/i/unrealircd-6-2-7-1-labeled-response-ircop-command-cve-2026-114713 https://pwn.watch/i/unrealircd-6-2-7-1-labeled-response-ircop-command-cve-2026-114713#2026-11-07-f14be2a6 Sat, 07 Nov 2026 00:00:00 GMT critical <p><a href="https://forums.unrealircd.org/viewtopic.php?t=9487">Source</a></p> UnrealIRCd before 6.2.7.1: any normal user can run commands with server/IRCOp authority (critical CVE-2026-114713) plus 8 more fixes: UnrealIRCd says UnrealIRCd 5 (EOL since 2023-07-01) is also affected by the critical bug; the workaround there is adding blacklist-module "labeled-response" to the config on all servers and restarting them. https://pwn.watch/i/unrealircd-6-2-7-1-labeled-response-ircop-command-cve-2026-114713 https://pwn.watch/i/unrealircd-6-2-7-1-labeled-response-ircop-command-cve-2026-114713#2026-11-07-b57e4ff3 Sat, 07 Nov 2026 00:00:00 GMT critical <p><a href="https://x.com/Unreal_IRCd/status/2119087387825619024">Source</a></p>