UnrealIRCd CVE-2026-114713: how to check your server and apply the hot-patch

In short: if you run UnrealIRCd 6.0.0 to 6.2.7 (or version 5), your server is affected. Version 6.2.7.1, released on 7 November 2026, fixes it, and a hot-patch does the job without a restart. The vendor reports attack attempts, and the US agency CISA added CVE-2026-114713 to its catalog of exploited vulnerabilities on 13 November (deadline for federal agencies: 16 November).

What is the problem?

The implementation of the IRCv3 label tag does not escape characters properly when it echoes the tag into replies. An ordinary user can therefore inject newlines and other characters into the traffic between linked servers. The injected commands run with the authority of the server, for example KILL or GLINE. The maintainer found the flaw himself in an internal audit done with the help of AI.

The CVE description mentions networks with two or more linked servers. The vendor advisory does not say so explicitly. Do not rely on it and patch a single server as well.

Are you affected?

• UnrealIRCd 6.0.0 to 6.2.7: yes.
• UnrealIRCd 5: also affected, a workaround is below.
• Check distribution packages: according to the Red Hat entry, EPEL 9 currently ships unrealircd-6.1.10-1.el9, which is affected.

Apply the hot-patch

On every server of the network, as the user that runs UnrealIRCd (works for 6.0.0 to 6.2.7):

./unrealircd hot-patch bundle-20261107

Success shows in the last line: “Patch installed and server rehashed correctly. All should be good now!”

Check that the patch is active

./unrealircd module-status | grep labeled-response

• labeled-response 5.0-hot-patch-bundle-20261107: the hot-patch is installed.
• Version 6.2.7.1: the fixed release is running.
• Only 5.0 without a patch bundle: the patch is still missing.
• No output: the command needs UnrealIRCd 6.0.2 or newer. As an IRCOp you can also use MODULE -all in chat (for another server MODULE -all server.name).

If the hot-patch does not work

On Linux and other Unix systems, upgrade and restart:

./unrealircd upgrade

On Windows, download 6.2.7.1 and restart.

A stopgap for now

As an IRCOp you can use a spamfilter. According to the advisory it protects against the critical issue only if all servers run UnrealIRCd 6.0.4 or newer:

SPAMFILTER add -regex T block - Invalid_label ^label=(?![^\r\n;\x20]*\z)

On UnrealIRCd 5, add blacklist-module "labeled-response"; to the configuration of all servers and restart (a rehash is not enough).

Afterwards

1. Write down which server runs which version and patch level, and since when.
2. Check the logs: unexpected KILL or GLINE entries can point to abuse (this is my recommendation, not part of the advisory).
3. The patch fixes nine issues, including IP leaks and several crashes, so the update is worthwhile even without an attack.

This post summarises the advisory by the UnrealIRCd maintainers and the Red Hat entry; I did not reproduce the flaw myself. Other entries CISA added the same day are in the overview of exploited vulnerabilities, for example CVE-2026-123039 (Check Point Gaia).