The webserver in UnrealIRCd 6.0.5 through 6.2.6 before 6.2.7 does not limit the number of HTTP request headers, which allows remote attackers to cause a denial of service (memory consumption and unresponsive server) via an HTTP request with an unlimited number of headers, if a websocket or JSON-RPC listener is enabled (disabled by default).

Sam James <sam () gentoo org> writes: <#secure method=pgpmime mode=sign> Neither Websockets nor JSON-RPC are enabled by default. When reviewing the commits in this release, I noticed an unrelated change in https://github.com/unrealircd/unrealircd/commit/072558bc1a539e9936584647df51fb1797c982b0.

It's a great example of the shape of many LLM-reported (I'm assuming) vulnerabilities:

""" Fix uninteresting MITM command injection in STARTTLS upgrade in S2S. This initially sounded interesting but turned out to be quite unspectacular. Here's the explanation:

1) This only applies to plaintext server links, something that is not standard practice for many years. Every decent server uses link::outgoing::options tls, which is TLS direct without STARTTLS. 2) In UnrealIRCd we automatically upgrade plaintext connections through STARTTLS. 3) A classic STARTTLS mistake/attack is smuggling some commands at the same time as the STARTTLS command/reply. We protect against this on one side of the link, but not the other. This is the bug. 4) For this an attacker need to be in the network path (eg a router) between the two servers and hijack the TCP/IP connection 5) Even then, the only effect is that an attacker could execute pre-auth commands, so not server commands, but only things like PASS, SERVER, PROTOCTL in this case. 6) So the only thing an attacker can do are things like injecting PROTOCTL lines to confuse server capabilities, or sending PASS/SERVER that will cause the link to be rejected.

So, pretty much totally uninteresting, but it is a bug :) """

It reflects the experience I've had with these. They're generally good at finding real bugs but not always so much at assessing the impact or understanding them in context.

And kudos to syzop for explaining it well. -------------------- Start of forwarded message -------------------- Date: Sat, 12 Sep 2026 15:41:14 +0200 Subject: UnrealIRCd 6.2.7 released & hot-patch to fix security issues for existing installations To: UnrealIRCd Release Announcements <unreal-notify () lists sourceforge net> From: Bram Matthys via Unreal-notify <unreal-notify () lists sourceforge net>

<#multipart type=mixed> <#multipart type=alternative> <#part type=text/plain format="flowed" charset="UTF-8" disposition=inline nofile=yes> Hi everyone,

This UnrealIRCd 6.2.7 release fixes multiple issues in the webserver module which allow an attacker to consume a lot of memory and stall the IRCd. If you use Websockets <https://www.unrealircd.org/docs/WebSocketsupport> or JSON-RPC <https://www.unrealircd.org/docs/JSON-RPC> then we recommend to either upgrade or hot-patch.

A good strategy may be to hot-patch now to fix the most urgent issues and plan an upgrade to 6.2.7 at a more convenient time somewhere in the upcoming weeks.

Fix without restart (hot-patch)

The hot-patch allows you to update the server without a restart on UnrealIRCd 6.2.x and may also work on older (unsupported) versions. To do so, run: |./unrealircd hot-patch webserver-header-dos|

Upgrade to the complete 6.2.7 release (with restart)

Note that the hot-patch /only/ fixes the issues mentioned above. This release contains other fixes and enhancements. You can read all about it in the release notes below. As always, you can download UnrealIRCd from unrealircd.org <https://www.unrealircd.org/>. On NIX you can upgrade to 6.2.7 (if you are ok with an ircd restart) with the command: ./unrealircd upgrade

Enhancements:

New set::anti-flood <https://www.unrealircd.org/docs/Anti-floodsettings#max-processing-time> setting |max-processing-time|: this limits how much time we spend on a particular client in the I/O engine. This gives other clients a more fair chance to get their commands read and processed. Defaults to 25ms for unknown-users and 50ms for known-users. IRCOps can use |WHO| with Extended Server Bans <https://www.unrealircd.org/docs/Extendedserverbans> for things like |WHO ~asn:64496|, |WHO ~country:NL| and |WHO ~security-group:unknown-users|.

Changes:

Update shipped libs: c-ares (1.34.8, security fixes) The GeoIP <https://www.unrealircd.org/docs/GeoIP> engine was already switched to |geoipmmdb| in 6.2.4 for new installations. We now change the default for existing installations as well. The old engine |geoipclassic| is now deprecated and we will stop database updates for classic somewhere in 2027. Added minimal self-check for Argon2 (fail early instead of crashing)

Fixes:

Resource exhaustion attack in the webserver. Previously we had no restriction on HTTP request headers, so a client could make a big request which would consume a lot of memory and stall the IRCd. This only affects servers with a listen block with |listen::options::websocket| (for Websockets <https://www.unrealircd.org/docs/WebSocketsupport>) or |listen::options::rpc| (for JSON-RPC <https://www.unrealircd.org/docs/JSON-RPC>). See the top of these release notes, especially the hot-patch. Websocket pings were limited in size but not throttled Crash when using crule functions <https://www.unrealircd.org/docs/Crule> |matchasname()| or when using |unicodecount('Nonexistent Block')|. Crash with JSON-RPC method |rpc.deltimer| Crash with |REHASH -dns| if linking to a server (race condition) AntiMixedUTF8 <https://www.unrealircd.org/docs/Setblock#set::antimixedutf8> gave some emoji a way too high score. Race condition in server linking. If a server was trying to link to multiple servers at once, then the servers could clash causing a connect+split. This could happen in the non-standard configuration where set::server-linking::autoconnect-strategy <https://www.unrealircd.org/docs/Setblock#set::server-linking> was set to |parallel| instead of the default |sequential|. This change means that |parallel| should now be safe to use. The memory log, that JSON-RPC log.getall uses, was cleaned up too much. Channel mode |+f| type |r| (repeat) has normalization (like ignoring upper/lowercase and color), but this normalization was accidently ignored.

Developers and protocol:

New wiki articles: Dev:Coding guidelines <https://www.unrealircd.org/docs/Dev:Codingguidelines> and Dev:Visual Studio Code <https://www.unrealircd.org/docs/Dev:VisualStudioCode>. After more than 25 years, the entire source code has been reformatted in one big clang-format commit ('make format'), giving the whole tree a single consistent style. Git blame on github.com is unaffected thanks to |.git-blame-ignore-revs|. For local |git blame| to benefit as well, run this once in your working copy: |git config blame.ignoreRevsFile .git-blame-ignore-revs|. If you maintain a fork or local patches, then read the migration instructions in this commit message <https://github.com/unrealircd/unrealircd/commit/e77eb9e923e84853c0fb2a154150f401a9602e0b>. All C code must now be formatted with clang-format version 21: run |make format| before committing (or use clang-format in your editor). CI will check for this and fail a PR containing unformatted code. JSON-RPC <https://www.unrealircd.org/docs/JSON-RPC:Securitygroup> |securitygroup.list| and |securitygroup.get|: we now consistently have |builtin| on all built-in security groups, and a fix for missing |public| in unknown-users.

Best regards,

Bram Matthys, UnrealIRCd

<#part type=text/html charset="UTF-8" nofile=yes> <!DOCTYPE html> <html> <head> <meta http-equiv="content-type" content="text/html; charset=UTF-8"> </head> <body> <p>Hi everyone,</p> <p data-sourcepos="4:1-8:67" dir="auto">This UnrealIRCd 6.2.7 release fixes multiple issues in the webserver module which allow an attacker to consume a lot of memory and stall the IRCd. If you use <a moz-do-not-send="true" href="https://www.unrealircd.org/docs/WebSocketsupport";> Websockets</a> or <a moz-do-not-send="true" href="https://www.unrealircd.org/docs/JSON-RPC";>JSON-RPC</a> then we recommend to either upgrade or <strong>hot-patch</strong>.</p> <p data-sourcepos="4:1-8:67" dir="auto">A good strategy may be to hot-patch now to fix the most urgent issues and plan an upgrade to 6.2.7 at a more convenient time somewhere in the upcoming weeks.</p> <h3 data-sourcepos="17:1-17:17" class="heading-element" dir="auto">Fix without restart (hot-patch)</h3> <p data-sourcepos="4:1-8:67" dir="auto">The hot-patch allows you to update the server <strong>without a restart</strong> on UnrealIRCd 6.2.x and may also work on older (unsupported) versions.<br> To do so, run: <code>./unrealircd hot-patch webserver-header-dos</code></p> <h3 data-sourcepos="17:1-17:17" class="heading-element" dir="auto">Upgrade to the complete 6.2.7 release (with restart)</h3> <p data-sourcepos="12:1-15:54" dir="auto">Note that the hot-patch <em>only</em> fixes the issues mentioned above. This release contains other fixes and enhancements. You can read all about it in the release notes below.<br> As always, you can download UnrealIRCd from <a href="https://www.unrealircd.org/"; class="postlink" moz-do-not-send="true">unrealircd.org</a>. On NIX you can upgrade to 6.2.7 (if you are ok with an ircd restart) with the command: <font face="monospace">./unrealircd upgrade</font></p> <div class="markdown-heading" dir="auto"> <h3 data-sourcepos="17:1-17:17" class="heading-element" dir="auto">Enhancements:</h3> </div> <ul data-sourcepos="18:1-27:0" dir="auto"> <li data-sourcepos="18:1-22:41">New <a href="https://www.unrealircd.org/docs/Anti-floodsettings#max-processing-time"; rel="nofollow" moz-do-not-send="true">set::anti-flood</a> setting <code>max-processing-time</code>: this limits how much time we spend on a particular client in the I/O engine. This gives other clients a more fair chance to get their commands read and processed. Defaults to 25ms for unknown-users and 50ms for known-users.</li> <li data-sourcepos="23:1-27:0">IRCOps can use <code>WHO</code> with <a href="https://www.unrealircd.org/docs/Extendedserverbans"; rel="nofollow" moz-do-not-send="true">Extended Server Bans</a> for things like <code>WHO ~asn:64496</code>, <code>WHO ~country:NL</code> and <code>WHO ~security-group:unknown-users</code>.</li> </ul> <div class="markdown-heading" dir="auto"> <h3 data-sourcepos="28:1-28:12" class="heading-element" dir="auto">Changes:</h3> </div> <ul data-sourcepos="29:1-36:0" dir="auto"> <li data-sourcepos="29:1-29:54">Update shipped libs: c-ares (1.34.8, security fixes)</li> <li data-sourcepos="30:1-34:32">The <a href="https://www.unrealircd.org/docs/GeoIP"; rel="nofollow" moz-do-not-send="true">GeoIP</a> engine was already switched to <code>geoipmmdb</code> in 6.2.4 for new installations. We now change the default for existing installations as well. The old engine <code>geoipclassic</code> is now deprecated and we will stop database updates for classic somewhere in 2027.</li> <li data-sourcepos="35:1-36:0">Added minimal self-check for Argon2 (fail early instead of crashing)</li> </ul> <div class="markdown-heading" dir="auto"> <h3 data-sourcepos="37:1-37:10" class="heading-element" dir="auto">Fixes:</h3> </div> <ul data-sourcepos="38:1-62:0" dir="auto"> <li data-sourcepos="38:1-45:51">Resource exhaustion attack in the webserver. Previously we had no restriction on HTTP request headers, so a client could make a big request which would consume a lot of memory and stall the IRCd. This only affects servers with a listen block with <code>listen::options::websocket</code> (for <a href="https://www.unrealircd.org/docs/WebSocketsupport"; rel="nofollow" moz-do-not-send="true">Websockets</a>) or <code>listen::options::rpc</code> (for <a href="https://www.unrealircd.org/docs/JSON-RPC"; rel="nofollow" moz-do-not-send="true">JSON-RPC</a>). See the top of these release notes, especially the hot-patch.</li> <li data-sourcepos="46:1-46:56">Websocket pings were limited in size but not throttled</li> <li data-sourcepos="47:1-48:70">Crash when using <a href="https://www.unrealircd.org/docs/Crule"; rel="nofollow" moz-do-not-send="true">crule functions</a> <code>matchasname()</code> or when using <code>unicodecount('Nonexistent Block')</code>.</li> <li data-sourcepos="49:1-49:44">Crash with JSON-RPC method <code>rpc.deltimer</code></li> <li data-sourcepos="50:1-50:66">Crash with <code>REHASH -dns</code> if linking to a server (race condition)</li> <li data-sourcepos="51:1-52:39"><a href="https://www.unrealircd.org/docs/Setblock#set::antimixedutf8"; rel="nofollow" moz-do-not-send="true">AntiMixedUTF8</a> gave some emoji a way too high score.</li> <li data-sourcepos="53:1-58:50">Race condition in server linking. If a server was trying to link to multiple servers at once, then the servers could clash causing a connect+split. This could happen in the non-standard configuration where <a href="https://www.unrealircd.org/docs/Setblock#set::server-linking"; rel="nofollow" moz-do-not-send="true">set::server-linking::autoconnect-strategy</a> was set to <code>parallel</code> instead of the default <code>sequential</code>. This change means that <code>parallel</code> should now be safe to use.</li> <li data-sourcepos="59:1-59:73">The memory log, that JSON-RPC log.getall uses, was cleaned up too much.</li> <li data-sourcepos="60:1-62:0">Channel mode <code>+f</code> type <code>r</code> (repeat) has normalization (like ignoring upper/lowercase and color), but this normalization was accidently ignored.</li> </ul> <div class="markdown-heading" dir="auto"> <h3 data-sourcepos="63:1-63:28" class="heading-element" dir="auto">Developers and protocol:</h3> </div> <ul data-sourcepos="64:1-82:0" dir="auto"> <li data-sourcepos="64:1-65:87">New wiki articles: <a href="https://www.unrealircd.org/docs/Dev:Codingguidelines"; rel="nofollow" moz-do-not-send="true">Dev:Coding guidelines</a> and <a href="https://www.unrealircd.org/docs/Dev:VisualStudioCode"; rel="nofollow" moz-do-not-send="true">Dev:Visual Studio Code</a>.</li> <li data-sourcepos="66:1-74:114">After more than 25 years, the entire source code has been reformatted in one big clang-format commit ('make format'), giving the whole tree a single consistent style. Git blame on github.com is unaffected thanks to <code>.git-blame-ignore-revs</code>. For local <code>git blame</code> to benefit as well, run this once in your working copy: <code>git config blame.ignoreRevsFile .git-blame-ignore-revs</code>. If you maintain a fork or local patches, then read the migration instructions in <a href="https://github.com/unrealircd/unrealircd/commit/e77eb9e923e84853c0fb2a154150f401a9602e0b"; moz-do-not-send="true">this commit message</a>.</li> <li data-sourcepos="75:1-77:67">All C code must now be formatted with clang-format version 21: run <code>make format</code> <strong>before committing</strong> (or use clang-format in your editor). CI will check for this and fail a PR containing unformatted code.</li> <li data-sourcepos="78:1-82:0"><a href="https://www.unrealircd.org/docs/JSON-RPC:Securitygroup"; rel="nofollow" moz-do-not-send="true">JSON-RPC</a> <code>securitygroup.list</code> and <code>securitygroup.get</code>: we now consistently have <code>builtin</code> on all built-in security groups, and a fix for missing <code>public</code> in unknown-users.</li> </ul> <p>Best regards,</p> <p>Bram Matthys, UnrealIRCd</p> <p><br> </p> </body> </html> <#/multipart> <#part type=text/plain charset="us-ascii" disposition=inline nofile=yes> <#part type=text/plain charset="us-ascii" disposition=inline nofile=yes> Unreal-notify mailing list Unreal-notify () lists sourceforge net https://lists.sourceforge.net/lists/listinfo/unreal-notify <#/multipart> -------------------- End of forwarded message --------------------

Neither Websockets nor JSON-RPC are enabled by default.

-------------------- Start of forwarded message -------------------- Date: Sat, 12 Sep 2026 15:41:14 +0200 Subject: UnrealIRCd 6.2.7 released & hot-patch to fix security issues for existing installations To: UnrealIRCd Release Announcements <unreal-notify () lists sourceforge net> From: Bram Matthys via Unreal-notify <unreal-notify () lists sourceforge net> Hi everyone,

Fix without restart (hot-patch) To do so, run: |./unrealircd hot-patch webserver-header-dos|

Upgrade to the complete 6.2.7 release (with restart) Enhancements:

New set::anti-flood <https://www.unrealircd.org/docs/Anti-floodsettings#max-processing-time> setting |max-processing-time|: this limits how much time we spend on a particular client in the I/O engine. This gives other clients a more fair chance to get their commands read and processed. Defaults to 25ms for unknown-users and 50ms for known-users. IRCOps can use |WHO| with Extended Server Bans <https://www.unrealircd.org/docs/Extendedserverbans> for things like |WHO ~asn:64496|, |WHO ~country:NL| and |WHO ~security-group:unknown-users|.

Changes:

Update shipped libs: c-ares (1.34.8, security fixes) The GeoIP <https://www.unrealircd.org/docs/GeoIP> engine was already switched to |geoipmmdb| in 6.2.4 for new installations. We now change the default for existing installations as well. The old engine |geoipclassic| is now deprecated and we will stop database updates for classic somewhere in 2027. Added minimal self-check for Argon2 (fail early instead of crashing)

Fixes:

Resource exhaustion attack in the webserver. Previously we had no restriction on HTTP request headers, so a client could make a big request which would consume a lot of memory and stall the IRCd. This only affects servers with a listen block with |listen::options::websocket| (for Websockets <https://www.unrealircd.org/docs/WebSocketsupport>) or |listen::options::rpc| (for JSON-RPC <https://www.unrealircd.org/docs/JSON-RPC>). See the top of these release notes, especially the hot-patch. Websocket pings were limited in size but not throttled Crash when using crule functions <https://www.unrealircd.org/docs/Crule> |matchasname()| or when using |unicodecount('Nonexistent Block')|. Crash with JSON-RPC method |rpc.deltimer| Crash with |REHASH -dns| if linking to a server (race condition) AntiMixedUTF8 <https://www.unrealircd.org/docs/Setblock#set::antimixedutf8> gave some emoji a way too high score. Race condition in server linking. If a server was trying to link to multiple servers at once, then the servers could clash causing a connect+split. This could happen in the non-standard configuration where set::server-linking::autoconnect-strategy <https://www.unrealircd.org/docs/Setblock#set::server-linking> was set to |parallel| instead of the default |sequential|. This change means that |parallel| should now be safe to use. The memory log, that JSON-RPC log.getall uses, was cleaned up too much. Channel mode |+f| type |r| (repeat) has normalization (like ignoring upper/lowercase and color), but this normalization was accidently ignored.

Developers and protocol:

New wiki articles: Dev:Coding guidelines <https://www.unrealircd.org/docs/Dev:Codingguidelines> and Dev:Visual Studio Code <https://www.unrealircd.org/docs/Dev:VisualStudioCode>. After more than 25 years, the entire source code has been reformatted in one big clang-format commit ('make format'), giving the whole tree a single consistent style. Git blame on github.com is unaffected thanks to |.git-blame-ignore-revs|. For local |git blame| to benefit as well, run this once in your working copy: |git config blame.ignoreRevsFile .git-blame-ignore-revs|. If you maintain a fork or local patches, then read the migration instructions in this commit message <https://github.com/unrealircd/unrealircd/commit/e77eb9e923e84853c0fb2a154150f401a9602e0b>. All C code must now be formatted with clang-format version 21: run |make format| before committing (or use clang-format in your editor). CI will check for this and fail a PR containing unformatted code. JSON-RPC <https://www.unrealircd.org/docs/JSON-RPC:Securitygroup> |securitygroup.list| and |securitygroup.get|: we now consistently have |builtin| on all built-in security groups, and a fix for missing |public| in unknown-users.

Best regards,

Bram Matthys, UnrealIRCd Unreal-notify mailing list Unreal-notify () lists sourceforge net https://lists.sourceforge.net/lists/listinfo/unreal-notify -------------------- End of forwarded message --------------------

The mauthenticate function in modules/msasl.c in UnrealIRCd before 3.2.10.7 and 4.x before 4.0.6 allows remote attackers to spoof certificate fingerprints and consequently log in as another user via a crafted AUTHENTICATE parameter.

Use-after-free vulnerability in UnrealIRCd 3.2.10 before 3.2.10.2 allows remote attackers to cause a denial of service (crash) via unspecified vectors. NOTE: this identifier was SPLIT per ADT2 due to different vulnerability types. CVE-2013-7384 was assigned for the NULL pointer dereference.

UnrealIRCd 3.2.10 before 3.2.10.2 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via unspecified vectors, related to SSL. NOTE: this issue was SPLIT from CVE-2013-6413 per ADT2 due to different vulnerability types.

A buffer overflow in websockets in UnrealIRCd 6.1.0 through 6.1.3 before 6.1.4 allows an unauthenticated remote attacker to crash the server by sending an oversized packet (if a websocket port is open). Remote code execution might be possible on some uncommon, older platforms.

Latest version: 6.2.6

Latest version: 6.2.6

Buffer overflow in UnrealIRCd 3.2beta11 through 3.2.8, when allow::options::noident is enabled, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via unspecified vectors.

UnrealIRCd 3.2.8.1, as distributed on certain mirror sites from November 2009 through June 2010, contains an externally introduced modification (Trojan Horse) in the DEBUG3DOLOGSYSTEM macro, which allows remote attackers to execute arbitrary commands.

UnrealIRCd 4.0.13 and earlier creates a PID file after dropping privileges to a non-root account, which might allow local users to kill arbitrary processes by leveraging access to this non-root account for PID file modification before a root script executes a "kill cat /pathname" command. NOTE: the vendor indicates that there is no common or recommended scenario in which a root script would execute this kill command.

End of life: 12/31/2020, End of support: 5/20/2019, Latest version: 4.2.4.1

End of life: 12/31/2020, End of support: 5/20/2019, Latest version: 4.2.4.1