The Server-Server protocol implementation in ngIRCd before 26~rc2 allows an out-of-bounds access, as demonstrated by the IRC_NJOIN() function.
Source: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-14148
Reference (s):
- FEDORA:FEDORA-2020-8c33e3a771
- URL: https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JZRYFJIA6ZKOH7U4K5WH5OL7OKXE4N52/
- FEDORA:FEDORA-2020-e6d1d849c5
- URL: https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BJOYV5GHUFJMUVQW3TJKXZ7JPXL4W3ER/
- https://github.com/ngircd/ngircd/issues/274