CVE-2026-90668
Received Received - Intake

Denial of Service in UnrealIRCd via HTTP Header Flood

Publication date: 2026-09-13

Last updated on: 2026-09-13

Assigner: MITRE

Description
The webserver in UnrealIRCd 6.0.5 through 6.2.6 before 6.2.7 does not limit the number of HTTP request headers, which allows remote attackers to cause a denial of service (memory consumption and unresponsive server) via an HTTP request with an unlimited number of headers, if a websocket or JSON-RPC listener is enabled (disabled by default).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-13
Last Modified
2026-09-13
Generated
2026-09-13
AI Q&A
2026-09-13
EPSS Evaluated
N/A
NVD
CVE-2026-90668
EUVD
EUVD-2026-76937

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
unrealircd unrealircd to 6.2.7 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-770 The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The vulnerability in UnrealIRCd 6.0.5 through 6.2.6 before 6.2.7 involves the webserver not limiting HTTP request headers. This allows attackers to send requests with an unlimited number of headers, consuming excessive memory and making the server unresponsive. The issue specifically affects servers with websocket or JSON-RPC listeners enabled, which are disabled by default.

Detection Guidance

To detect this vulnerability, check if your UnrealIRCd server is running a vulnerable version (6.0.5 to 6.2.6) with a websocket or JSON-RPC listener enabled. Use commands like 'unrealircd version' to verify the version. Monitor server memory usage and responsiveness during HTTP requests with multiple headers. Check logs for unusual HTTP request patterns.

Impact Analysis

This vulnerability can cause a denial of service by exhausting server memory and CPU resources, leading to an unresponsive server. If you run UnrealIRCd with websocket or JSON-RPC listeners enabled, your server may become slow or crash under malicious HTTP requests.

Compliance Impact

This vulnerability causes a denial of service by consuming excessive memory due to unlimited HTTP headers, which could disrupt service availability. For GDPR, availability is a key principle, so prolonged outages may violate Article 32 requirements for security and integrity. HIPAA also mandates safeguards for data availability, so service disruptions could impact compliance if systems handling protected health information are affected.

Mitigation Strategies

Upgrade to UnrealIRCd 6.2.7 or later immediately, as it addresses this issue without requiring a restart. Disable websocket and JSON-RPC listeners if not needed. Restrict HTTP request header sizes in your server configuration. Monitor server performance and apply patches promptly.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-90668. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart