A long-standing issue was fixed in a recent version of ngircd, a
lightweight Internet Relay Chat server:

In a TLS-based server-server connection, the server certificate is
not validated.

github issue: https://github.com/ngircd/ngircd/issues/120

For reasons both upstream and I fail to understand, no CVE number was
assigned by MITRE.

For Debian unstable and testing, this has been fixed in 27~rc1-1,
uploaded April 13th.

For Debian 12 (stable, bookworm) and 11 (oldstable, bullseye), this will
be fixed in the upcoming stable point release on June 29th.

See https://bugs.debian.org/1074018 for details.

For Debian 10 (oldoldstable, buster), downstream distributions based on
it might want to peruse the attached debdiff. It fixes two other issues,
just the way it was done for the two newer stable releases:

1. In a server-server connection, a connection may still use
plain text despite the connection ought to be TLS-based.

2. Some IRC services might send an empty string for the hostname to
implement the "uncloak host" functionality, leading to a protocol
violation in subsequent "WHOIS" or other commands against the ngircd
server.

    Christoph