CVE-2026-114713
HIGH
NVD
CVSS Score
8.6
Severity
HIGH
Published
Nov 08, 2026
Vendor
unknown
Description
The labeled-response module in UnrealIRCd 6.0.0 before 6.2.7.1 does not escape the IRCv3 "label" message tag when echoing it into replies, which allows any user on a network with two or more linked servers to inject server-to-server commands that are executed with server authority.