UnrealIRCd hot-patch fixes actively exploited CVE-2026-114713 without a restart

UnrealIRCd maintainers have fixed a remotely exploitable flaw tracked as CVE-2026-114713, and remediation is unusually painless: a hot-patch closes the hole without restarting the IRC daemon. According to a dev.to write-up by Daniele Michelin that summarises the vendor advisory and the related Red Hat entry, the US agency CISA added the CVE to its catalog of known exploited vulnerabilities on 13 November 2026, with a 16 November deadline for federal agencies, and the vendor has already recorded attack attempts. The same CISA update covered other flaws, including CVE-2026-123039 for Check Point Gaia.

The complete fix ships in UnrealIRCd 6.2.7.1, released on 7 November 2026.

What the flaw is

The bug lives in UnrealIRCd's implementation of an IRCv3 feature known as labeled response. When a client attaches a label to a message, the server echoes that label back in its replies, but affected versions do not escape its contents properly. As a result, an ordinary user can smuggle newlines and other characters into the traffic between linked servers.

The injected commands run with the authority of the server itself, including operator-grade commands such as KILL and GLINE. The maintainer discovered the issue during an internal audit conducted with the help of AI, the write-up says.

There is a scope ambiguity worth noting: the CVE description frames the problem around networks of two or more linked servers, while the vendor advisory does not spell that out. Michelin's recommendation is not to lean on the linked-server framing and to patch single servers too.

Which versions are affected

Per the advisory as relayed on dev.to:

• UnrealIRCd 6.0.0 through 6.2.7 are vulnerable.
• UnrealIRCd 5 is also affected and needs a separate workaround described below.
• Distribution packages can lag behind: the Red Hat entry notes that EPEL 9 currently ships unrealircd-6.1.10-1.el9, which falls inside the affected range.

Applying the hot-patch

On every server of the network, running as the user that owns the UnrealIRCd process, and valid for 6.0.0 through 6.2.7:

./unrealircd hot-patch bundle-20261107

A successful run ends with the line "Patch installed and server rehashed correctly. All should be good now!"

Verification is one command:

./unrealircd module-status | grep labeled-response

Interpreting the output: a line reading labeled-response 5.0-hot-patch-bundle-20261107 means the hot-patch is in place; 6.2.7.1 means the fixed release is running; a bare 5.0 with no bundle suffix means the patch is missing. No output at all signals that the command needs UnrealIRCd 6.0.2 or newer, and IRC operators can instead issue MODULE -all in chat, or MODULE -all server.name for another server.

If the hot-patch refuses to apply, the fallback on Linux and other Unix systems is ./unrealircd upgrade followed by a restart. On Windows, download 6.2.7.1 and restart.

Stopgaps where patching is not immediately possible

For networks where every server runs UnrealIRCd 6.0.4 or newer, an IRCOp can add a spamfilter rule that blocks malformed labels and buys time:

SPAMFILTER add -regex T block - Invalid_label ^label=(?![^\r\n;\x20]*\z)

UnrealIRCd 5 has no hot-patch path described in the write-up; the advised workaround is to add blacklist-module "labeled-response"; to the configuration of every server and restart, since a rehash is not sufficient.

More than one bug fixed

The bundle reportedly addresses nine issues in total, including IP leaks and several crashes, so upgrading pays off even for admins who doubt they are a target. Michelin adds two housekeeping suggestions of his own, explicitly not part of the advisory: record which server runs which version and patch level, and review logs for unexpected KILL or GLINE entries that could indicate abuse. He also notes that he did not reproduce the flaw himself and is relaying the vendor's advisory.

Why it matters

This is a textbook case for low-friction incident response: a CISA-listed vulnerability with confirmed attack attempts, where the official fix needs zero downtime. The impact is larger than it first appears, since any ordinary user can issue commands with server authority, and on IRC that means forced disconnects and network-wide bans, plus potential manipulation of inter-server trust. The EPEL detail is a reminder that "installed from the package manager" is not the same as "patched". And the fact that an AI-assisted internal audit surfaced the bug hints at how even small open-source projects are tightening their security processes. For any UnrealIRCd admin the checklist is short: check the version, run the hot-patch, verify with module-status.