CVE-2026-114713 Details
Description
The labeled-response module in UnrealIRCd 6.0.0 before 6.2.7.1 does not escape the IRCv3 "label" message tag when echoing it into replies, which allows any user on a network with two or more linked servers to inject server-to-server commands that are executed with server authority.
A vulnerability in the labeled-response module of UnrealIRCd versions 6.0.0 prior to 6.2.7.1 allows users to inject server-to-server commands that are executed with server authority. This issue arises because the IRCv3 'label' message tag is not properly escaped when echoed in replies. The vulnerability can be exploited by any user on a network with two or more linked servers.
UnrealIRCd 6.2.7.1 has been released to address this vulnerability. This version can be hot-patched into existing UnrealIRCd 6 installations without requiring a server restart.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Nov 8, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| http://www.openwall.com/lists/oss-security/2026/11/08/1 | CVE | |
| https://forums.unrealircd.org/viewtopic.php?t=9487 | [email protected] | Content WallVendor |
| https://www.unrealircd.org/ | [email protected] | Vendor |
| https://www.unrealircd.org/index/news | [email protected] | AdvisoryBundleVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-140 | Improper Neutralization of Delimiters | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| UnrealIRCd | < 6.2.7.1 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 8, 2026 | CVE Modified | CVE |
| Nov 8, 2026 | New CVE Received | [email protected] |