CVE-2026-90668CWE-770denial-of-service

CVE-2026-90668

High · published September 13, 2026

CVSS v3.1
7.5
EPSS
1%
Percentile
47.0
In the wild
Unconfirmed
What it is

The webserver in UnrealIRCd 6.0.5 through 6.2.6 before 6.2.7 does not limit the number of HTTP request headers, which allows remote attackers to cause a denial of service (memory consumption and unresponsive server) via an HTTP request with an unlimited number of headers, if a websocket or JSON-RPC listener is enabled (disabled by default).

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
8.7 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/AU:Y/R:A/RE:L
EPSS
0.00582 · 47.0th percentile
Weakness
CWE-770 · Allocation of Resources Without Limits or Throttling
Published
2026-09-13T06:17Z
References (2)
https://forums.unrealircd.org/viewtopic.php?t=9483 · [email protected]https://www.unrealircd.org/ · [email protected]
EPSS history
Timeline
  • 15 SEP 03:22Z
    EPSS moved — → 0%
    epss
  • 13 SEP 02:00Z
    The webserver in UnrealIRCd 6.0.5 through 6.2.6 before 6.2.7 does not limit the number of HTTP request headers, which allows remote attackers to cause a denial…
    cvelistv5