https://seclists.org/oss-sec/2026/q3/729: UnalIRCd 6.2.7 leased & hot-patch to fix security issues for existing installations
Published Sep 13, 2026
·Updated
Affected Software
1 affected component
UnrealIRCd UnrealIRCd<=6.2.6
The issue applies to plaintext server-to-server links that use STARTTLS upgrading. Deployments using direct TLS for outgoing links via link::outgoing::options tls are not in the described attack scenario; plaintext links have not been standard practice for many years.
An attacker must be on the network path between the two servers, such as at a router, and be able to hijack the TCP/IP connection. The issue involves smuggling commands alongside the STARTTLS command or reply.
Avoid plaintext server links and configure direct TLS for outgoing links using link::outgoing::options tls. This removes reliance on STARTTLS upgrading for the server link.