An UnrealIRCd Bug Lets Ordinary Chat Users Issue Server Commands, and Attackers Are Using It

An ordinary user on a vulnerable UnrealIRCd chat network can send commands with the authority of a server. Attackers are exploiting that gap, and CISA has now added CVE-2026-114713 to its Known Exploited Vulnerabilities catalog, with a November 16 remediation deadline for covered federal agencies.

The November 13 listing raises the urgency of a fix that has been available since November 7. UnrealIRCd's maintainer had already reported abuse attempts the day after releasing it. For operators who missed that warning, the risk has moved well beyond a bug found in an audit.

A chat message crosses the trust boundary

The flaw sits in UnrealIRCd's handling of the IRCv3 label message tag. In his technical disclosure, maintainer Bram Matthys explains that a user can slip newlines into traffic passed between servers. Those extra lines become commands executed with server authority on a network with two or more linked servers.

That can let a normal user disconnect other users or impose network-wide bans. The authority comes from how the message is processed, without the sender first becoming an IRC operator. CISA's entry does not identify the attackers or quantify compromised networks, and it lists ransomware use as unknown.

The fix can be applied without taking most networks down

The project's release advisory offers a hot patch for supported Unix-like systems running UnrealIRCd 6.0.0 through 6.2.7, or an upgrade to 6.2.7.1. Windows operators need the upgrade route. The maintainer also provides a temporary filter workaround, which depends on all linked servers running 6.0.4 or newer.

The full update addresses nine security issues, including crashes and IP-address disclosure. Applying only the temporary workaround leaves those other problems unresolved. Operators also need to verify the patched module on each server rather than assume one protected node covers the network.

UnrealIRCd 5 is affected too, despite having reached end of life in July 2023. The advisory gives it separate emergency guidance, but the project's recommendation is to move to the supported 6 series. A forgotten chat server can still carry the authority of the network it belongs to.

Some offers on this page may be paid placements or contain affiliate links.