CVE-2026-90668

The built-in webserver in UnrealIRCd 6.0.5 through 6.2.6 (fixed in 6.2.7) does not limit how many HTTP request headers a client may send, an unbounded resource allocation flaw (CWE-770). A remote, unauthenticated attacker can exhaust server memory and render the IRC daemon unresponsive by sending a single HTTP request containing a huge number of headers. Only deployments that have enabled the websocket or JSON-RPC listener are reachable via this path, and those listeners are disabled in the default configuration. CVSS 4.0 is rated high (8.7) due to full availability impact with no privileges required. No public proof-of-concept or known in-the-wild exploitation has been reported, and the issue is not on the CISA KEV list.

What to do: Upgrade to UnrealIRCd 6.2.7 or later. If immediate patching is not possible, disable the websocket and JSON-RPC listeners in the listen blocks (or firewall/admin-restrict the web ports), since these are off by default. Watch for abnormal memory growth or unresponsiveness on any server that had a web listener exposed to untrusted clients.