CVE-2026-114713

CVE-2026-114713 is a vulnerability in UnrealIRCd that affects versions 6.0.0 through 6.2.7, as well as the legacy UnrealIRCd 5 branch. The flaw is located within the software's labeled-response module, which fails to properly escape the IRCv3 "label" message tag when echoing it back into replies. On IRC networks configured with two or more linked servers, this improper neutralization of delimiters allows any ordinary user to inject server-to-server commands. Because these injected commands are executed with server authority, a regular user can issue operator-level commands—such as KILL and GLINE—to disconnect users and ban them network-wide. The Cybersecurity and Infrastructure Security Agency (CISA) has added this vulnerability to its Known Exploited Vulnerabilities (KEV) catalog due to evidence of active exploitation in the wild. To address the issue, UnrealIRCd released version 6.2.7.1. Server administrators can remediate the flaw by upgrading to the new version, applying an official hot-patch that does not require a server restart, or deploying a temporary spamfilter workaround. For legacy UnrealIRCd 5 installations, the recommended mitigation is to blacklist the labeled-response module and restart the server.