CVE-2026-90668: High severity UnrealIRCd UnrealIRCd vulnerability
The webserver in UnrealIRCd 6.0.5 through 6.2.6 before 6.2.7 does not limit the number of HTTP request headers, which allows remote attackers to cause a denial of service (memory consumption and unresponsive server) via an HTTP request with an unlimited number of headers, if a websocket or JSON-RPC listener is enabled (disabled by default).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
UnrealIRCdto a version that resolves this vulnerability.Fixed in 6.2.7 - Upgrade
Upgrade
UnrealIRCdto a version that resolves this vulnerability.Patch webserver-header-dos
Event History
Frequently Asked Questions
Which deployments are exposed to this denial-of-service issue?
UnrealIRCd versions 6.0.5 through 6.2.6 are affected only when a websocket or JSON-RPC listener is enabled. These listeners are disabled by default, so installations that have not enabled either listener are not exposed through this condition.
What does an attacker need to exploit it?
An attacker can exploit the issue remotely without privileges or user interaction by sending an HTTP request containing an unlimited number of headers to an enabled websocket or JSON-RPC listener.
What is the operational impact of a successful attack?
Excessive HTTP headers can cause memory consumption and leave the server unresponsive, resulting in denial of service. The provided information does not indicate confidentiality or integrity impact.
What can be done if an update cannot be applied immediately?
Disable websocket and JSON-RPC listeners if they are not required. Because those listeners are disabled by default, reverting them to the default disabled state removes the described exposure.
How can administrators determine whether they are affected?
Check whether the UnrealIRCd version is from 6.0.5 through 6.2.6 and whether a websocket or JSON-RPC listener is enabled. Systems running 6.2.7 or later are outside the affected version range stated in the advisory.