CVE-2026-114713: UnrealIRCd Improper Neutralization of Delimiters Vulnerability

EPSS trend

Probability

0.30%

Chance of exploitation in the next 30 days

Percentile

23%

Versus all other CVEs

30-day change

Change unavailable

08-11-202613-11-2026

Known exploited

Compare KEV catalogs

CISA KEVListed

Added: 13-11-2026
Federal due date: 16-11-2026

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

CISA required action

Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. forums.unrealircd.org/viewtopic.php?t=9487 nvd.nist.gov/vuln/detail/CVE-2026-114713

Public exploits

0 found

No public exploits indexed.

References

6 links

Related vulnerabilities

PrioritiseCVE-2026-90668unrealircd2mo agounrealircd unrealircdThe webserver in UnrealIRCd 6.0.5 through 6.2.6 before 6.2.7 does not limit the number of HTTP request headers, which allows remote attackers to cause a denial of service (memory consumption and unresponsive server) via an HTTP request with an unlimited number of headers, if a websocket or JSON-RPC listener is enabled (disabled by default).CVSS8.7HighEPSS0.58%PrioritiseCVE-2023-50784unrealircd2y agounrealircd unrealircdA buffer overflow in websockets in UnrealIRCd 6.1.0 through 6.1.3 before 6.1.4 allows an unauthenticated remote attacker to crash the server by sending an oversized packet (if a websocket port is open). Remote code execution might be possible on some uncommon, older platforms.CVSS7.5HighEPSS1.92%RoutineCVE-2017-13649unrealircd9y agounrealircd unrealircdUnrealIRCd 4.0.13 and earlier creates a PID file after dropping privileges to a non-root account, which might allow local users to kill arbitrary processes by leveraging access to this non-root account for PID file modification before a root script executes a "kill `cat /pathname`" command. NOTE: the vendor indicates that there is no common or recommended scenario in which a root script would execute this kill command.CVSS5.5MediumEPSS0.28%PrioritiseCVE-2016-7144unrealircd9y agounrealircd unrealircdThe m_authenticate function in modules/m_sasl.c in UnrealIRCd before 3.2.10.7 and 4.x before 4.0.6 allows remote attackers to spoof certificate fingerprints and consequently log in as another user via a crafted AUTHENTICATE parameter.CVSS8.1HighEPSS1.27%RoutineCVE-2013-7384unrealircd12y agounrealircd unrealircdUnrealIRCd 3.2.10 before 3.2.10.2 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via unspecified vectors, related to SSL. NOTE: this issue was SPLIT from CVE-2013-6413 per ADT2 due to different vulnerability types.CVSS5.0MediumEPSS2.37%RoutineCVE-2013-6413unrealircd12y agounrealircd unrealircdUse-after-free vulnerability in UnrealIRCd 3.2.10 before 3.2.10.2 allows remote attackers to cause a denial of service (crash) via unspecified vectors. NOTE: this identifier was SPLIT per ADT2 due to different vulnerability types. CVE-2013-7384 was assigned for the NULL pointer dereference.CVSS5.0MediumEPSS2.37%

All vulnerabilities inunrealircd

Vulnerability summary

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References