high · CVSS v3 8.6

CVE-2026-114713

The labeled-response module in UnrealIRCd 6.0.0 before 6.2.7.1 does not escape the IRCv3 "label" message tag when echoin…

Description

The labeled-response module in UnrealIRCd 6.0.0 before 6.2.7.1 does not escape the IRCv3 "label" message tag when echoing it into replies, which allows any user on a network with two or more linked servers to inject server-to-server commands that are executed with server authority.

Scores

Severity
high
CVSS v2
7.8
CVSS v3
8.6
CVSS v4
—
EPSS
—

← All CVEs

Related CVEs

high

CVE-2026-123558

Zebra zebrad before 7.0.0 is vulnerable to a denial‑of‑service that can be triggered by a malicious peer during checkpoint synchronization. By cancelling the verifier rewind after a failed commit, an attacker can cause the node to reject legitimate blocks until it is restarted. This disrupts network availability and can stall consensus.

View analysis

high

CVE-2026-123559

Zebra before 7.0.0 contains an inefficient algorithmic complexity vulnerability that allows unauthenticated peers to exhaust verification threads by submitting transactions with many transparent inputs. Attackers can relay invalid transactions with tens of thousands of inputs, forcing quadratic ZIP-244 or ZIP-243 digest recomputation that stalls Rayon-backed block verification for minutes.

View analysis

high

CVE-2026-123560

Zebra before 7.0.0 contains an incomplete cleanup vulnerability that allows unauthenticated peers to stall initial sync by serving a forged checkpoint block body. Attackers can supply a body with forged authorizing data near the final checkpoint, leaving rejected hashes in the sent-hash set so the node stops requesting blocks until restart.

View analysis

high

CVE-2026-123562

devalue (sveltejs/devalue) 5.8.0 before 5.9.3 contains an unhandled promise rejection in stringifyAsync: when serializing multiple promises, a later promise rejecting before an earlier one settles leaves an internal rejection unhandled, even if the caller catches the returned promise. An attacker able to influence the timing or failure of serialized asynchronous values can terminate the Node.js process.

View analysis