CVE-2026-90668: UnrealIRCd HTTP Header DoS Vulnerability

CVE-2026-90668 Overview

CVE-2026-90668 is a denial of service vulnerability in the UnrealIRCd webserver component. The flaw affects UnrealIRCd versions 6.0.5 through 6.2.6 and is fixed in 6.2.7. The webserver does not limit the number of HTTP request headers it accepts. Remote attackers can send a single HTTP request containing an unbounded number of headers to exhaust server memory and render the daemon unresponsive. The issue only exposes a server if the websocket or JSON-RPC listener is enabled, which is not the default configuration. The vulnerability is classified as [CWE-770] Allocation of Resources Without Limits or Throttling.

Critical Impact
An unauthenticated network attacker can exhaust server memory and crash UnrealIRCd instances that expose a websocket or JSON-RPC listener.

Affected Products

UnrealIRCd 6.0.5 through 6.2.6
UnrealIRCd deployments with websocket listener enabled
UnrealIRCd deployments with JSON-RPC listener enabled

Discovery Timeline

2026-09-13 - CVE-2026-90668 published to the National Vulnerability Database
2026-09-14 - Last updated in NVD database

Technical Details for CVE-2026-90668

Vulnerability Analysis

The UnrealIRCd webserver parses inbound HTTP requests to support the optional websocket and JSON-RPC listeners. The parser accepts and buffers header lines without enforcing a maximum count. A remote client can hold a single connection open and stream headers continuously, forcing the server to allocate memory for each header until the process exhausts available memory or becomes unresponsive.

The defect only manifests when an administrator has explicitly enabled a websocket or JSON-RPC listener. Default installations that only accept IRC protocol traffic are not exposed. Because IRC daemons often run as long-lived, network-facing services with elevated availability requirements, sustained memory pressure can disrupt chat operations for all connected users. See the UnrealIRCd Forum Discussion for maintainer commentary.

Root Cause

The root cause is missing input validation on the number of HTTP headers per request. The webserver code path allocates storage per header without checking cumulative count or memory usage against a fixed ceiling, satisfying the conditions described in [CWE-770].

Attack Vector

Exploitation requires network access to a listener that speaks HTTP, specifically the websocket or JSON-RPC endpoint. No authentication or user interaction is required. The attacker opens a TCP connection, begins an HTTP request, and continuously writes header lines. The malformed or oversized request causes the process to consume memory until it is killed by the operating system or stops responding to legitimate clients. The exploit does not require any specialized tooling and can be reproduced with a basic socket client. No public proof-of-concept is currently referenced in the advisory.

Detection Methods for CVE-2026-90668

Indicators of Compromise

HTTP requests to the UnrealIRCd websocket or JSON-RPC port containing thousands of header lines
Sustained upward memory growth of the unrealircd process without a corresponding increase in connected IRC users
Repeated out-of-memory kills of the UnrealIRCd process in system logs such as dmesg or journalctl
Unexplained loss of responsiveness on the websocket or JSON-RPC listener while the standard IRC port continues to accept connections

Detection Strategies

Alert on any HTTP request to the UnrealIRCd webserver whose header count exceeds a reasonable threshold, for example 100 headers
Correlate resident set size (RSS) growth of the unrealircd process with concurrent inbound connections on the websocket or JSON-RPC port
Ingest UnrealIRCd logs into a centralized analytics platform and hunt for repeated abrupt disconnects on the HTTP listener from the same source address

Monitoring Recommendations

Enable process-level memory monitoring on hosts running UnrealIRCd and alert on RSS crossing a configured ceiling
Deploy a reverse proxy such as nginx or haproxy in front of the websocket or JSON-RPC listener to log per-request header counts and sizes
Monitor kernel OOM killer events and correlate them with the UnrealIRCd service unit

How to Mitigate CVE-2026-90668

Immediate Actions Required

Upgrade all UnrealIRCd deployments to version 6.2.7 or later
Audit unrealircd.conf for any listen block using options { websocket; } or options { rpc; } and disable if not required
Restrict network access to websocket and JSON-RPC listeners using host firewalls to trusted management networks
Restart the unrealircd service after applying the update to clear any resident memory pressure

Patch Information

The vendor fixed CVE-2026-90668 in UnrealIRCd 6.2.7. Administrators should download the latest release from the UnrealIRCd Official Website and follow the standard upgrade procedure. Configuration files from 6.0.5 through 6.2.6 remain compatible, so the upgrade path does not require rewriting existing listener definitions.

Workarounds

Disable the websocket listener in unrealircd.conf until the patched version is deployed
Disable the JSON-RPC listener in unrealircd.conf until the patched version is deployed
Place a reverse proxy in front of any HTTP listener and configure it to cap the number and total size of request headers, for example large_client_header_buffers in nginx
Apply per-source connection rate limits at the firewall to reduce the likelihood of sustained abuse

bash

# Example nginx reverse proxy caps for UnrealIRCd websocket/JSON-RPC listener
server {
    listen 8000;
    client_header_buffer_size 1k;
    large_client_header_buffers 4 8k;
    client_max_body_size 64k;

    location / {
        proxy_pass http://127.0.0.1:8600;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
    }
}