MajorCritical vulnerability
CVE-2026-114713 (CVSS 8.6)
NVD · officialPublished Nov 8, 2026Risk 37/100EPSS 0.3%
The labeled-response module in UnrealIRCd 6.0.0 before 6.2.7.1 does not escape the IRCv3 "label" message tag when echoing it into replies, which allows any user on a network with two or more linked servers to inject server-to-server commands that are executed with server authority.
Technical details
CVSS
8.6
AV:NetworkAC:LowPR:NoneUI:NoneC:NoneI:HighA:None
Evidence and sources
This record is attributed to NVD. Exploitation status and remediation guidance are kept separate from the vulnerability's technical severity.
Open primary source