HIGH 8.6 NVD
CVE-2026-114713
The labeled-response module in UnrealIRCd 6.0.0 before 6.2.7.1 does not escape the IRCv3 "label" message tag when echoing it into replies, which allows any user
The labeled-response module in UnrealIRCd 6.0.0 before 6.2.7.1 does not escape the IRCv3 "label" message tag when echoing it into replies, which allows any user on a network with two or more linked servers to inject server-to-server commands that are executed with server authority.
References
- https://forums.unrealircd.org/viewtopic.php?t=9487
- https://www.unrealircd.org/
- https://www.unrealircd.org/index/news
- http://www.openwall.com/lists/oss-security/2026/11/08/1
- https://www.openwall.com/lists/oss-security/2026/11/08/1
This high severity vulnerability with a CVSS score of 8.6 was published on 2026-11-08 via NVD.
vulnfeed aggregates 16937 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.