Executive brief
UnrealIRCd is an open-source IRC server widely deployed for chat networks. The built-in webserver fails to limit the number of HTTP request headers, allowing an attacker to send requests with excessive headers that consume memory and exhaust server resources, causing the service to become unresponsive. This only affects installations that have enabled the optional WebSocket or JSON-RPC listeners.
Technical details
The vulnerability is a denial-of-service flaw in UnrealIRCd's webserver module, where insufficient validation of HTTP request headers permits an attacker to send unlimited headers in a single request. The root cause is the absence of a header count limit in the HTTP parsing logic. An attacker with network access can exploit this via a specially crafted HTTP request; no authentication is required. The attack causes excessive memory consumption and server unresponsiveness. The vulnerability is exploitable only if WebSocket or JSON-RPC listeners are enabled in the configuration (disabled by default). A patch is available in UnrealIRCd 6.2.7, released on September 12, 2026.
Affected products
- UnrealIRCd UnrealIRCd 6.0.5 through 6.2.6
Timeline
- 2026-09-13: disclosed
- 2026-09-12: patched: Fixed in version 6.2.7