Skip to content
NewA calmer, faster ZeroHour
StoryVulnerabilitylow

UnrealIRCd 6.2.7 release and hot-patch fix security issues, including MITM command injection in STARTTLS S2S upgrade

1 source · 2 articlesFirst reported Updated ()6 · 1 read
What's new

First merged summary for this story: combined the UnrealIRCd 6.2.7 release/hot-patch announcement, the default-disabled status of Websockets and JSON-RPC, and details of the MITM-only STARTTLS S2S command injection fix.

Merged summary · glm-5.3 · rewritten as coverage arrivesSummaries by Vani AI

UnrealIRCd 6.2.7 ships with a hot-patch for existing installs fixing a minor man-in-the-middle command injection in STARTTLS server-to-server links; affected Websockets and JSON-RPC interfaces are disabled by default, limiting exposure.

Sam Sykes/James posts on oss-security (2026-09-13) announce UnrealIRCd 6.2.7 and a hot-patch for existing installations addressing security issues. A follow-up clarification states that the Websockets and JSON-RPC interfaces involved in the fixes are disabled by default, so default configurations are not exposed to those affected interfaces. A cited commit fixes a command injection occurring during the STARTTLS upgrade on server-to-server links, exploitable only by an attacker in a man-in-the-middle position; the reviewer characterized this issue as uninteresting and cited it as an example of the typical shape of LLM-generated vulnerability findings.

Key facts
  • UnrealIRCd 6.2.7 released on or around 2026-09-13, with a hot-patch available for existing installations
  • One fixed issue is a command injection during the STARTTLS upgrade of server-to-server (S2S) links, exploitable only from a man-in-the-middle position
  • Websockets and JSON-RPC interfaces, which are also involved in the security fixes, are disabled by default; default configurations are not exposed to the affected interfaces
  • The reviewer (Sam James) rated the STARTTLS command injection as minor/uninteresting and cited it as an example of typical LLM-generated vulnerability report patterns
  • Reports sourced from oss-security mailing list, both dated 2026-09-13
Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat

Coverage

oldest first · one row per article · UTC
  1. · Sep 13, 2026 oss-securityFirst report

    Fwd: UnrealIRCd 6.2.7 released & hot-patch to fix security issues for existing installations

    Clarification: UnrealIRCd Websockets and JSON-RPC interfaces involved in 6.2.7 security fixes are disabled by default.

  2. · Sep 13, 2026 oss-security

    Re: UnrealIRCd 6.2.7 released & hot-patch to fix security issues for existing installations

    UnrealIRCd 6.2.7 hot-patch fixes a minor MITM command injection in STARTTLS S2S upgrade, flagged as LLM-reported.