UnrealIRCd has released version 6.2.7.1 to fix nine security issues, including a critical flaw tracked as CVE-2026-114713 that the vendor says attackers are already exploiting on the internet. The project calls it the most serious issue found in UnrealIRCd in 15 years.

The flaw sits in the labeled-response module, which fails to escape the IRCv3 "label" message tag when echoing it into replies. On a network with two or more linked servers, any ordinary user can inject server-to-server commands that run with server authority. That means a regular user could issue operator-level commands such as KILL and GLINE, disconnecting users and banning them network-wide.

The vulnerability, scored 8.6 on the CVSS scale, affects UnrealIRCd 6.0.0 through 6.2.7. The other eight issues fixed in the same release include flaws that let a normal user reveal another user's IP address, crash the server, or hang it through a blacklist check.

Server operators have two options: apply the hot-patch without restarting, by running ./unrealircd hot-patch bundle-20261107, or upgrade to 6.2.7.1 and restart. The vendor urges operators to apply a spamfilter workaround first, as it gives immediate protection on servers running 6.0.4 or newer. UnrealIRCd 5, which reached end of life in July 2023, is affected by the same critical flaw, and its only mitigation is to blacklist the labeled-response module and restart.