The critical issue (CVE-2026-114713) allows normal users to execute commands with server/IRCOp authority. This means any ordinary user can KILL, GLINE, and do many more bad things. This is the most critical issue found in UnrealIRCd in the past 15 years. The other security issues are crashes, hangs, DoS and there is also an issue fixed which allows any ordinary user to "decloak" a user (reveal the IP address of the victim).
As promised, on almost all UnrealIRCd 6 networks all these security issues can be hot-patched without restart (no downtime).
If you are running UnrealIRCd versions that are end of life: UnrealIRCd 3.2.x, 4 or 5 then see the section near the end.
IMPORTANT: Please do step 1 first, it gives you some protection right away. Then proceed to step 2a or 2b.
Step 1: First, apply the workaround right now
Before you do anything, run the following as an IRCOp on the network:
Code: Select all
/SPAMFILTER add -regex T block - Invalid_label ^label=(?![^\r\n;\x20]*\z)Now go to step 2a (hot-patch) or if that is not for you then use step 2b (upgrade to 6.2.7.1) instead.
Step 2a: Fix the issues without restart
If you are on Windows, or you are on *NIX but hot-patching below fails, then go to step 2b (upgrade).
Run the following command on every UnrealIRCd server. This works on UnrealIRCd 6.0.0 - 6.2.7:
Code: Select all
./unrealircd hot-patch bundle-20261107If something went wrong (you did not get that output) then please check out FAQ: Hot-patching failed. It contains answers for several scenarios, including a distro upgrade case which can break the build.
Now, you still want to verify that you are really patched. To do so, you can run this on the same shell (this only works on 6.0.2 and later):
Code: Select all
./unrealircd module-status|grep labeled-response- This means the hot-patch is properly installed (server is safe): labeled-response 5.0-hot-patch-bundle-20261107
- If it says 6.2.7.1 then the server was not hot-patched but is running the fixed version 6.2.7.1 (server is also safe)
- If it says only 5.0 (without the patch bundle) then the hot-patch was NOT applied.
- If you get no output at all then try the IRC method, see next.
You can also check remote IRC servers (again, as IRCOp), through: MODULE -all remote.server.name
If the verification failed, check out the FAQ: Hot-patching failed or simply do step 2b (upgrade instead).
Step 2b: OR, upgrade to 6.2.7.1 (with restart)
If using the hot-patch is not possible or didn't work, then upgrade to 6.2.7.1:
On *NIX you can simply run: ./unrealircd upgrade and after that restart the IRC server.
Windows users, or anyone else who prefers doing so, can also download the 6.2.7.1 release from www.unrealircd.org.
Full list of fixed issues
For completeness, here are the 9 issues that are fixed through the hot-patch and in 6.2.7.1:
- A CRITICAL issue that can be abused by any normal user to execute commands with server or IRCOp authority. This means any ordinary user can KILL, GLINE, and do many more bad things. (CVE-2026-114713)
- A normal user could "decloak" another user, revealing the IP address of the victim.
- Another leak of the IP address
- Blacklist recheck could hang the server
- Crash on CHGIDENT from Services, which a normal user can trigger
- Counting error which could cause a "This server is full" message to every new connect, until the server is restarted.
- Limit the number of bans Services can set, to 2x set::maxbans
- Potential flood issue with TLS renegotiations
- Possible crash on whowasdb
UnrealIRCd 5 is similarly affected by the critical issue (so any regular user can execute commands as server/IRCOp). Note that UnrealIRCd 5 has been End of Life since 2023-07-01. Nobody should be running this version.
If you do use UnrealIRCd 5, the workaround is adding this to your configuration file on all your servers AND restarting them (NOT rehash):
blacklist-module "labeled-response";
Other End of Life UnrealIRCd versions have not been checked. It is likely that several bugs that are fixed in 6.2.7.1 go all the way back to 3.2.x.
Please read the next section as well, as you are not safe if you run an EOL version. You are not safe at all.
Final words: the danger of AI is real
I have been doing security audits on UnrealIRCd for decades now. Back in 2001 I was using static code analyzer tools and found a bunch of crashes. Later on in the 2010's fuzzing was the new big thing and when I used it on UnrealIRCd it found lots of issues again. Then AI came. First the quality of AI was not so good but things improved and improved. Since Feb 2026 I have spent about 100 hours with AI doing security audits and to improve the quality of the codebase. Especially the last month things have been wild. The things AI can find nowadays are amazing.
I genuinely think that, if you are running any network daemon that has not seen any major security fixes in the past couple of months, then nobody has been poking at that daemon with AI. Or some bad guy did but did not report back. This is also true for people running End of Life UnrealIRCd releases: you think your 3.2.x has no vulnerabilities? It is only because bad guys haven't been looking at exploiting your servers. You should not be running EOL software. Upgrade to UnrealIRCd 6. It's a modern IRC server, it's worth it.
Updates
Any updates to this advisory will happen here in this post.