UnrealIRCd patches actively exploited IRCv3 label-tag vulnerability

UnrealIRCd's maintainers published version 6.2.7.1 and a hot-patch to correct nine security problems, among them CVE-2026-114713, which they report is being exploited in the wild, the Centre for Cybersecurity Belgium said in a 9 November 2026 advisory.

The advisory gives the vulnerability a CVSS 3.1 score of 8.6 and classifies it as CWE-140, improper neutralization of delimiters. An unauthenticated attacker on a network with two or more linked IRC servers can run any server-to-server command using the privileges of a server, the CCB said. With that power, the attacker can change server settings, modify how the network behaves and damage the IRC infrastructure's integrity, the advisory states.

The flaw sits in UnrealIRCd's labeled-response module, which does not escape the IRCv3 "label" message tag when echoing it into replies, the advisory explains. The CCB recommends installing the update for vulnerable devices "with the highest priority after thorough testing" and increasing monitoring and detection to spot related suspicious activity. It notes that patching protects against future exploitation but does not remediate historic compromise.