CVE-2026-90668

HighCVSS 7.5

Published: 13/09/2026(UTC)Updated: 14/09/2026(UTC)Translated: 13/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.33%

26th percentile - higher than 26% of all known CVEs

Summary

In UnrealIRCd 6.0.5 through 6.2.6 before 6.2.7, the webserver does not limit the number of HTTP request headers. A remote attacker can send a request with an unlimited number of headers, causing memory consumption and an unresponsive server, if a websocket or JSON-RPC listener is enabled (disabled by default).

Risk Assessment

The vulnerability allows remote attackers to cause a denial of service by exhausting memory and making the IRC server unresponsive. The risk applies only to installations with websocket or JSON-RPC listeners enabled.

Recommendation

Update UnrealIRCd to version 6.2.7 or later. If websocket/JSON-RPC listeners are not needed, keep them disabled; otherwise, consider limiting the number of headers at the proxy level.

Other vulnerabilities in UnrealIRCd

CVE-2016-7144High
The m_authenticate function in UnrealIRCd before 3.2.10.7 and 4.x before 4.0.6 allows remote attackers to spoof certificate fingerprints, enabling them to log in as another user via a crafted AUTHENTICATE parameter.

Original NVD description (English source)

The webserver in UnrealIRCd 6.0.5 through 6.2.6 before 6.2.7 does not limit the number of HTTP request headers, which allows remote attackers to cause a denial of service (memory consumption and unresponsive server) via an HTTP request with an unlimited number of headers, if a websocket or JSON-RPC listener is enabled (disabled by default).