CVE-2026-114713

Summary

The labeled-response module in UnrealIRCd 6.0.0–6.2.7 fails to escape the IRCv3 'label' message tag when echoing it in server-to-server replies, enabling unauthenticated command injection via malformed labels. This allows any network user on a multi-server setup to execute arbitrary server-authority commands.

Exploitability

Exploitation requires only network access to an affected UnrealIRCd instance with at least two linked servers; no authentication or user interaction is needed.

Blast radius

Successful exploitation grants attackers server-level command execution authority across the entire IRC network, potentially enabling full compromise of all connected servers and data exfiltration or disruption.

Detection

Defenders should monitor server-to-server protocol logs for unexpected or malformed IRCv3 'label' tags containing unescaped control characters (e.g., colons, spaces, or line breaks) in echo responses; such anomalies may indicate injection attempts targeting server commands.

Prioritized remediation

Upgrade to UnrealIRCd 6.2.7.1 or later, which patches the label tag escaping vulnerability in the labeled-response module.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.