{"id":"CVE-2026-121602","kind":"vulnerability","aliases":["CVE-2026-121602"],"related":[],"title":"Solanum IRC server: linked-server overlong channel names overflow heap memory","description":"Solanum before commit 2ce64de contains a heap-based buffer overflow vulnerability that allows a malicious linked server to corrupt memory by sending overlong channel names in JOIN or SJOIN messages. Attackers controlling a peer server can trigger strcpy and sprintf overflows in ms_join and ms_sjoin to crash the ircd or potentially achieve remote code execution.","summary":"Solanum, an IRC server daemon, copies channel names from JOIN and SJOIN messages into fixed-size buffers without a length check. A malicious server linked to it can send overlong names to crash the daemon or potentially run code on it.","severity":"high","cvss":8.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["irc","package","self-hosted","solanum"],"not_affected_if":["no-server-links","not-solanum"],"how_to_check":"- Check whether the server runs Solanum and what commit it was built from; the sources say the fix is commit `2ce64de` or later.\n- Check whether the server accepts server-to-server links from peers you do not fully control.","fix":"- Solanum: move to commit `2ce64de` or later (sources give no release version).","status":"open","published_at":"2026-11-03T17:18:11+00:00","first_seen_at":"2026-11-03T17:21:56+00:00","triaged_at":"2026-11-03T17:23:59+00:00","updated_at":"2026-11-03T17:23:59+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-03T17:23:59Z","model":"claude-haiku-5-5","output":{"fix":"- Solanum: move to commit `2ce64de` or later (sources give no release version).","reach":"network","title":"Solanum IRC server: linked-server overlong channel names overflow heap memory","impact":"high","summary":"Solanum, an IRC server daemon, copies channel names from JOIN and SJOIN messages into fixed-size buffers without a length check. A malicious server linked to it can send overlong names to crash the daemon or potentially run code on it.","audience":"businesses","category":"package","nicknames":[],"who_cares":["solanum","irc","self-hosted"],"confidence":0.6,"fix_status":"available","needs_auth":"yes","worst_case":"Crashes the IRC server or potentially runs code on it","analyst_note":"Confirm the fixed commit and any release version from the linked patch and the VulnCheck advisory; the source text does not say whether a server link must be authenticated.","how_to_check":"- Check whether the server runs Solanum and what commit it was built from; the sources say the fix is commit `2ce64de` or later.\n- Check whether the server accepts server-to-server links from peers you do not fully control.","plain_action":"","needs_analyst":true,"not_affected_if":["no-server-links","not-solanum"],"who_is_affected":"Only Solanum servers that accept server links from peers are exposed, since the flaw is triggered by a malicious linked server sending JOIN or SJOIN messages. Standalone servers with no server links are not reached by this path, and the sources do not say whether other configurations are affected.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000699,"input_tokens":4193,"output_tokens":559,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-121602':15A,18A '-2026':14A,17A '2ce64de':68C 'achiev':119C 'allow':78C 'attack':96C 'base':73C 'buffer':42B,74C 'channel':8A,31B,89C 'check':46B 'code':64B,121C 'commit':67C 'contain':69C 'control':97C 'copi':30B 'corrupt':84C 'crash':58B,114C 'cve':13A,16A 'daemon':29B,60B 'execut':122C 'fix':40B 'fixed-s':39B 'heap':11A,72C 'heap-bas':71C 'host':23B 'irc':2A,19B,27B 'ircd':116C 'join':34B,92C,109C 'length':45B 'link':5A,50B,81C 'linked-serv':4A 'malici':48B,80C 'memori':12A,85C 'messag':37B,95C 'ms':108C,111C 'name':9A,32B,56B,90C 'overflow':10A,75C,106C 'overlong':7A,55B,88C 'packag':20B 'peer':99C 'potenti':62B,118C 'remot':120C 'run':63B 'self':22B 'self-host':21B 'send':54B,87C 'server':3A,6A,28B,49B,82C,100C 'size':41B 'sjoin':36B,94C,112C 'solanum':1A,24B,25B,65C 'sprintf':105C 'strcpi':103C 'trigger':102C 'vulner':76C 'without':43B","nicknames":[],"mitigations":[],"who_affected":"Only Solanum servers that accept server links from peers are exposed, since the flaw is triggered by a malicious linked server sending JOIN or SJOIN messages. Standalone servers with no server links are not reached by this path, and the sources do not say whether other configurations are affected.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["high","irc","package","selfhosted","solanum"],"campaign_type":null,"first_public_at":"2026-11-03T17:18:11+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-121602","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-121602","severity":null,"published_at":"2026-11-03T17:18:11+00:00","modified_at":"2026-11-03T17:18:11+00:00","first_seen_at":"2026-11-03T17:21:56+00:00","fetched_at":"2026-11-03T17:21:56+00:00","note":null}],"documents":[{"id":59255,"url":"https://github.com/solanum-ircd/solanum/commit/2ce64debf65e9710e9eea099ada93dbf6655b5ff","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":59256,"url":"https://www.vulncheck.com/advisories/solanum-before-commit-2ce64de-heap-buffer-overflow-via-join-and-sjoin","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}