# CVE-2026-90668: UnrealIRCd webserver HTTP header denial of service

Source: https://junglewise.ai/threats/cve-2026-90668-unrealircd-webserver-http-header-denial-of-service  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-13. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-90668 · Severity: high · CVSS 7.5 · Published 2026-09-13

UnrealIRCd is an open-source IRC server widely deployed for chat networks. The built-in webserver fails to limit the number of HTTP request headers, allowing an attacker to send requests with excessive headers that consume memory and exhaust server resources, causing the service to become unresponsive. This only affects installations that have enabled the optional WebSocket or JSON-RPC listeners.

Technologies: [Unrealircd](https://junglewise.ai/threats/technologies/unrealircd). Vendors: [Unrealircd](https://junglewise.ai/threats/vendors/unrealircd).

## Quick answers

**Is CVE-2026-90668 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-90668 being exploited in the wild.

**How severe is CVE-2026-90668?** High severity, with a CVSS score of 7.5, published 13 September 2026.

**Which products and versions are affected?** Unrealircd 6.0.5 through 6.2.6.

**Is there a fix for CVE-2026-90668?** A patch was published on 2026-09-12: Fixed in version 6.2.7 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-90668 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-90668?** Check whether you run Unrealircd at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a denial-of-service flaw in UnrealIRCd's webserver module, where insufficient validation of HTTP request headers permits an attacker to send unlimited headers in a single request. The root cause is the absence of a header count limit in the HTTP parsing logic. An attacker with network access can exploit this via a specially crafted HTTP request; no authentication is required. The attack causes excessive memory consumption and server unresponsiveness. The vulnerability is exploitable only if WebSocket or JSON-RPC listeners are enabled in the configuration (disabled by default). A patch is available in UnrealIRCd 6.2.7, released on September 12, 2026.

## Affected products

- UnrealIRCd UnrealIRCd 6.0.5 through 6.2.6

## Timeline

- 2026-09-13: disclosed
- 2026-09-12: patched: Fixed in version 6.2.7

## References

- [https://forums.unrealircd.org/viewtopic.php?t=9483](https://forums.unrealircd.org/viewtopic.php?t=9483)
- [https://www.unrealircd.org/](https://www.unrealircd.org/)

## Related threats

- [UnrealIRCd labeled-response command injection](https://junglewise.ai/threats/cve-2026-114713-the-labeled-response-module-in-unrealircd-6-0-0-before-6-2-7-1)
- [UnrealIRCd authentication bypass in SASL module](https://junglewise.ai/threats/cve-2016-7144-unrealircd-authentication-bypass-in-sasl-module)