UnrealIRCd Forums

For what it's worth, I spoke her a week ago.

I also wrote an item on my personal blog about hot patching: Why hot-patching is awesome. It looks at the successes we had (and didn't have) with hot-patching in the past 20 years.

Because I think it is indeed... awesome

This was assigned CVE-2026-90668.

And it's out here.

Hi everyone,

As promised, here is the 6.2.7 release and the hot-patch to fix the issues without restart:

This UnrealIRCd 6.2.7 release fixes multiple issues in the webserver module which allow an attacker to consume a lot of memory and stall the IRCd. If you use Websockets or JSON-RPC then we ...

On Saturday 12 September 2026 at 14:00 UTC we will release UnrealIRCd 6.2.7 along with a hot-patch for UnrealIRCd 6.2.x. This fixes a Denial of Service issue in a significant number of servers that was recently discovered during an internal audit.

We will send an announcement to the mailing list ...

No, there is no such way. Once fake lag kicks in, the next command is simply not read/processed yet, so even if it 2would exist, then bufferclear or whatever would never be read until... the lag is already gone.

And just to be clear: UnrealIRCd is probably doing nearly nothing, usually little CPU ...

Maybe I am mixing you with another French network, but last time someone was talking about big connect times it turned out their client was sending something like this:
CAP REQ :xxx
CAP REQ :yyy
CAP REQ :zzz
and so on.. for like 10-15 caps.. so lots of lines (and you actually get quite some lines ...

The bug tracker bug should be fixed now. I'll report it upstream to the MantisBT people. Basically picking any product version caused a failure, except for level developers and above (which is why i didn't get the bug).

Yeah sorry there is a problem with the bug tracker. I should really look into it today or tomorrow .

We don't have that ability atm. I do have an (internal, not public) feature request for that exact feature open though.

UnrealIRCd 6.2.6 enables multiline by default, adds TKL IDs and tracking of hit counts on *LINES/Spamfilter. New crule functions were added to fetch server flood counts. Guidance to admins for server linking with 'spkifp' has been improved.

A crash bug in the multiline implementation in 6.2.4/6.2.5 ...

The Release Candidate for future version 6.2.6 is now available for testing. The stable version is scheduled ~2 weeks from now.

This version enables multiline by default, adds TKL IDs and tracking of hit counts on *LINES/Spamfilter. New crule functions were added to fetch server flood counts ...

That's a debug message that shows you the user is accepted by CBL. If you are saying: "but the user does not show up online after this?" then it means something else is not allowing the user in. I know, it is a tad confusing, but it can happen due to the ping cookie test (initial PING/PONG), maybe ...

GeoIP files had a 403 error. This is now fixed.

I've been doing a server (software) upgrade on the machine serving the *.unrealircd.org sites. If anything is not working, please let me know. Sometimes these are hard for me to spot.