https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2021-33586.htmlhttps://patchthecve.com/cve/CVE-2021-33586.htmlWed, 17 Jun 2026 03:54:49 +0000MEDIUM 4.3: InspIRCd 3.8.0 through 3.9.x before 3.10.0 allows any user (able to connect to the server) to access recently deallocated memory, aka the "malformed PONG" issue.https://patchthecve.com/cve/CVE-2020-25269.htmlhttps://patchthecve.com/cve/CVE-2020-25269.htmlWed, 17 Jun 2026 03:06:41 +0000MEDIUM 6.5: An issue was discovered in InspIRCd 2 before 2.0.29 and 3 before 3.6.0. The pgsql module contains a use after free vulnerability. When combined with the sqlauth or sqloper modules, this vulnerability can be used for remote crashing of an InspIRCd server by any user able to connect to a server.https://patchthecve.com/cve/CVE-2019-20918.htmlhttps://patchthecve.com/cve/CVE-2019-20918.htmlWed, 17 Jun 2026 02:31:26 +0000MEDIUM 6.5: An issue was discovered in InspIRCd 3 before 3.1.0. The silence module contains a use after free vulnerability. This vulnerability can be used for remote crashing of an InspIRCd server by any user able to fully connect to a server.https://patchthecve.com/cve/CVE-2019-20917.htmlhttps://patchthecve.com/cve/CVE-2019-20917.htmlWed, 17 Jun 2026 02:31:26 +0000MEDIUM 6.5: An issue was discovered in InspIRCd 2 before 2.0.28 and 3 before 3.3.0. The mysql module contains a NULL pointer dereference when built against mariadb-connector-c 3.0.5 or newer. When combined with the sqlauth or sqloper modules, this vulnerability can be used for remote crashing of an InspIRCd serhttps://patchthecve.com/cve/CVE-2012-6696.htmlhttps://patchthecve.com/cve/CVE-2012-6696.htmlTue, 16 Jun 2026 23:48:37 +0000CRITICAL 9.8: inspircd in Debian before 2.0.7 does not properly handle unsigned integers. NOTE: This vulnerability exists because of an incomplete fix to CVE-2012-1836.https://patchthecve.com/cve/CVE-2015-6674.htmlhttps://patchthecve.com/cve/CVE-2015-6674.htmlWed, 17 Jun 2026 00:31:13 +0000CRITICAL 9.8: Buffer underflow vulnerability in the Debian inspircd package before 2.0.5-1+deb7u1 for wheezy and before 2.0.16-1 for jessie and sid. NOTE: This issue exists as an additional issue from an incomplete fix of CVE-2012-1836.https://patchthecve.com/cve/CVE-2012-6697.htmlhttps://patchthecve.com/cve/CVE-2012-6697.htmlTue, 16 Jun 2026 23:48:37 +0000HIGH 7.5: InspIRCd before 2.0.7 allows remote attackers to cause a denial of service (infinite loop).https://patchthecve.com/cve/CVE-2016-7142.htmlhttps://patchthecve.com/cve/CVE-2016-7142.htmlWed, 17 Jun 2026 00:52:40 +0000MEDIUM 5.9: The m_sasl module in InspIRCd before 2.0.23, when used with a service that supports SASL_EXTERNAL authentication, allows remote attackers to spoof certificate fingerprints and consequently log in as another user via a crafted SASL message.https://patchthecve.com/cve/CVE-2015-8702.htmlhttps://patchthecve.com/cve/CVE-2015-8702.htmlWed, 17 Jun 2026 00:35:03 +0000HIGH 8.6: The DNS::GetResult function in dns.cpp in InspIRCd before 2.0.19 allows remote DNS servers to cause a denial of service (netsplit) via an invalid character in a PTR response, as demonstrated by a "\032" (whitespace) character in a hostname.https://patchthecve.com/cve/CVE-2012-1836.htmlhttps://patchthecve.com/cve/CVE-2012-1836.htmlTue, 16 Jun 2026 23:40:23 +0000HIGH 7.5: Heap-based buffer overflow in dns.cpp in InspIRCd 2.0.5 might allow remote attackers to execute arbitrary code via a crafted DNS query that uses compression.