UnrealIRCd vulnerabilities
We track 3 vulnerabilities in UnrealIRCd products. 3 are rated high or critical, and 1 has been exploited in real attacks. The most recent was published on November 8, 2026.
Latest UnrealIRCd vulnerabilities
- 8.6 High severity
UnrealIRCd Improper Neutralization of Delimiters Exploited
The labeled-response module in UnrealIRCd 6.0.0 before 6.2.7.1 does not escape the IRCv3 "label" message tag when echoing it into replies, which allows any user on a network with two or more linked servers to inject server-to-server commands that are executed
- 7.5 High severity
UnrealIRCd: Allocation of Resources Without Limits or Throttling
The webserver in UnrealIRCd 6.0.5 through 6.2.6 before 6.2.7 does not limit the number of HTTP request headers, which allows remote attackers to cause a denial of service (memory consumption and unresponsive server) via an HTTP request with an unlimited number
- 7.5 High severity
Unrealircd: Buffer Copy without Checking Size of Input
A buffer overflow in websockets in UnrealIRCd 6.1.0 through 6.1.3 before 6.1.4 allows an unauthenticated remote attacker to crash the server by sending an oversized packet (if a websocket port is open). Remote code execution might be possible on some uncommon,