UnrealIRCd: escaping bug

UnrealIRCd

UnrealIRCd has an escaping bug in its IRCv3 implementation, allowing users to inject newlines and issue arbitrary commands with server authority.

Do this now

Check the UnrealIRCd vendor advisory for a fix and restrict access to the IRCv3 features until one is confirmed.

Who should check: teams running Chat apps

First seen: 8 Nov 2026
Last update: 8 Nov 2026, 09:17 UTC
Versions per the CVE record from mitre, not the vendor: 6.2.7.1
Identifiers: CVE-2026-114713
CVSS: 8.6
Source: news
On the menu as: Chat apps

Check this repository for exposure to one security incident from pwned.coffee. Report first, change nothing until I say so.

## UnrealIRCd: escaping bug
Severity: high. Patch status: fix status unknown.
Affected: UnrealIRCd
Versions per the CVE record from mitre, not the vendor: 6.2.7.1
Ids: CVE-2026-114713

UnrealIRCd has an escaping bug in its IRCv3 implementation, allowing users to inject newlines and issue arbitrary commands with server authority.

## Steps
1. Search the repo, its CI and infra config for UnrealIRCd. If present, report the version in use and whether it's affected.
2. Versions per the CVE record from mitre, not the vendor: UnrealIRCd: 6.2.7.1. Don't treat them as a fix until the vendor says so.

## Fix by release line
| Line | State | Fix | Until then |
|---|---|---|---|
| UnrealIRCd | per the CVE record from mitre, not the vendor | 6.2.7.1 | restrict network access to it |

## Report
A table: file, product or package, version in use, affected yes/no, exact fix. Then anything a human has to check outside the repo.

If you have the pwned.coffee MCP server (https://pwned.coffee/mcp), call lookup_cve("CVE-2026-114713") for the latest, and check_repo with this repo's lockfiles, Dockerfiles and workflows for a full receipt.
Sources: https://seclists.org/oss-sec/2026/q4/576
https://pwned.coffee/i/unrealircd-escaping-bug-cve-2026-114713

Timeline

8 Nov 2026, 09:17 UTC
Fix status: patched → unknown.
8 Nov 2026
First reported.

Receipt

Exploitation: No known exploitation
By release line, per the CVE record from mitre, not the vendor: Product Affected Version named Source
UnrealIRCd before 6.2.7.1 6.2.7.1 CVE record (CNA) per the CVE record from mitre, not the vendor checked 13 Nov
Score: CVSS 8.6 (high). CVSS 3.1 8.6 (CNA mitre) for CVE-2026-114713
Last checked: 13 Nov 2026, 16:26 UTC

Product	Affected	Version named	Source
UnrealIRCd	before 6.2.7.1	6.2.7.1	CVE record (CNA) per the CVE record from mitre, not the vendor checked 13 Nov

Sources: KEV – CVE record ✓ Vendor –

Sources

seclists.org: UnrealIRCd 6.2.7.1 released & hot-patch (CVE-2026-114713)

Follow on X

Totalone hot coffee