UnrealIRCd 6.2.7 release and hot-patch fix security issues, including MITM command injection in STARTTLS S2S upgrade

UnrealIRCd 6.2.7 ships with a hot-patch for existing installs fixing a minor man-in-the-middle command injection in STARTTLS server-to-server links; affected Websockets and JSON-RPC interfaces are disabled by default, limiting exposure.

Sam Sykes/James posts on oss-security (2026-09-13) announce UnrealIRCd 6.2.7 and a hot-patch for existing installations addressing security issues. A follow-up clarification states that the Websockets and JSON-RPC interfaces involved in the fixes are disabled by default, so default configurations are not exposed to those affected interfaces. A cited commit fixes a command injection occurring during the STARTTLS upgrade on server-to-server links, exploitable only by an attacker in a man-in-the-middle position; the reviewer characterized this issue as uninteresting and cited it as an example of the typical shape of LLM-generated vulnerability findings.

• UnrealIRCd 6.2.7 released on or around 2026-09-13, with a hot-patch available for existing installations
• One fixed issue is a command injection during the STARTTLS upgrade of server-to-server (S2S) links, exploitable only from a man-in-the-middle position
• Websockets and JSON-RPC interfaces, which are also involved in the security fixes, are disabled by default; default configurations are not exposed to the affected interfaces
• The reviewer (Sam James) rated the STARTTLS command injection as minor/uninteresting and cited it as an example of typical LLM-generated vulnerability report patterns
• Reports sourced from oss-security mailing list, both dated 2026-09-13