high7.5
CVE-2026-90668
The webserver in UnrealIRCd 6.0.5 through 6.2.6 before 6.2.7 does not limit the number of HTTP request headers, which allows remote attackers to cause a denial…
Impact
The webserver in UnrealIRCd 6.0.5 through 6.2.6 before 6.2.7 does not limit the number of HTTP request headers, which allows remote attackers to cause a denial of service (memory consumption and unresponsive server) via an HTTP request with an unlimited number of headers, if a websocket or JSON-RPC listener is enabled (disabled by default).
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| UnrealIRCd | UnrealIRCd 6.0.5 | through 6.2.6 |
Versions were read from the advisory text. No structured product data has been published for this record yet.