In short: if you run UnrealIRCd 6.0.0 to 6.2.7 (or version 5), your server is affected. Version 6.2.7.1, released on 7 November 2026, fixes it, and a hot-patch does the job without a restart. The vendor reports attack attempts, and the US agency CISA added CVE-2026-114713 to its catalog of exploited
vulnerabilities on 13 November (deadline for federal agencies: 16 November). The implementation of the IRCv3 label tag does not escape characters properly when it echoes the tag into replies. An ordinary user can therefore inject newlines and other characters into the traffic between linked servers. The injected commands run with the authority of the server, for example KILL or GLINE.
The maintainer found the flaw himself in an internal audit done with the help of AI. The CVE description mentions networks with two or more linked servers. The vendor advisory does not say so explicitly. Do not rely on it and patch a single server as well.
UnrealIRCd 6.0.0 to 6.2.7: yes. UnrealIRCd 5: also affected, a workaround is below. Check distribution packages: according to the Red Hat entry, EPEL 9 currently ships unrealircd-6.1.10-1.el9, which is affected. On every server of the network, as the user that runs UnrealIRCd (works for 6.0.0 to 6.2.7): ./unrealircd hot-patch bundle-20261107 Success shows in the last line: “Patch installed and server rehashed correctly.
All should be good now!” ./unrealircd module-status | grep labeled-response labeled-response 5.0-hot-patch-bundle-20261107: the hot-patch is installed. Version 6.2.7.1: the fixed release is running. Only 5.0 without a patch bundle: the patch is still missing. No output: the command needs UnrealIRCd 6.0.2 or newer.
As an IRCOp you can also use MODULE -all in chat (for another server MODULE -all server.name). On Linux and other Unix systems, upgrade and restart: ./unrealircd upgrade On Windows, download 6.2.7.1 and restart. As an IRCOp you can use a spamfilter. According to the advisory it protects against the critical issue only if all servers run UnrealIRCd 6.0.4 or newer: SPAMFILTER add -regex T block - Invalid_label ^label=(?![^\r\n;\x20]*\z) On UnrealIRCd 5, add blacklist-module "labeled-response"; to the configuration of all servers and restart (a rehash is not enough).
Write down which server runs which version and patch level, and since when. Check the logs: unexpected KILL or GLINE entries can point to abuse (this is my recommendation, not part of the advisory). The patch fixes nine issues, including IP leaks and several crashes, so the update is worthwhile even without an attack. This post summarises the advisory by the UnrealIRCd maintainers and the Red Hat entry; I did not reproduce the flaw myself.
Other entries CISA added the same day are in the overview of exploited vulnerabilities, for example CVE-2026-123039 (Check Point Gaia). Originally published at daniele-michelin.com. More guides, free checks (SPF, TLS, headers) and an error-message lexicon: daniele-michelin.com/en/.
Key Takeaways #
- •The implementation of the IRCv3 label tag does not escape characters properly when it echoes the tag into replies.
- •This story was reported by Dev.to , covering developments in thedev space.
- •AI advancements continue to reshape industries — read the full article on Dev.to for complete coverage.
📖 Continue reading the full article: