UnrealIRCd 6.2.7.1 released with hot-patch for label tag escaping bug (CVE-2026-114713)
Original title: UnrealIRCd 6.2.7.1 released & hot-patch (CVE-2026-114713)
The escaping bug allows injecting arbitrary commands into IRC server traffic using the label message tag.
UnrealIRCd developers released version 6.2.7.1 with a hot-patch for CVE-2026-114713. The vulnerability is an escaping bug in the IRCv3 label message tag implementation. Any user can inject newlines and other characters into server-to-server traffic, potentially allowing arbitrary commands to be issued with server authority.
- UnrealIRCd 6.2.7.1 is the fixed version.
- Hot-patch released on November 7, 2026.
- Affects IRCv3 label message tag.
- Injecting newlines enables arbitrary server commands.
- CVE-2026-114713 published.
Impact: Arbitrary command injection with server authority
- 1.Upgrade to UnrealIRCd 6.2.7.1
- 2.Apply hot-patch for label message tag
- 3.Monitor IRC server-to-server traffic for anomalies
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-114713 | Label tag injection in UnrealIRCd before 6.2.7.1 | 8.6 | — |
From the original article
Posted by Bram Matthys on Nov 08 Last Saturday, 7-Nov-2026, I put out a security release and hot-patch for UnrealIRCd. The CVE entry CVE-2026-114713 has been published now. This is an escaping bug in UnrealIRCd's implementation of the IRCv3 "label" message tag.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.