Denial of Service Vulnerability in UnrealIRCd Webserver by UnrealIRCd

CVE-2026-90668

What is CVE-2026-90668?

The webserver component of UnrealIRCd versions 6.0.5 through 6.2.6 is susceptible to a denial of service condition due to the failure to limit the number of HTTP request headers processed. This vulnerability can be exploited by remote attackers, particularly when the webserver is configured to enable websocket or JSON-RPC listeners, resulting in significant memory consumption and leading to an unresponsive server. Users are advised to limit usage of these features or upgrade to version 6.2.7 or later to mitigate risks.

References