What is GHSA-fj9c-wr2v-556h?

GHSA-fj9c-wr2v-556h is a security advisory published by GitHub Security Advisories with High severity. The webserver in UnrealIRCd 6.0.5 through 6.2.6 before 6.2.7 does not limit the number of HTTP...

Which CVE IDs does GHSA-fj9c-wr2v-556h cover?

GHSA-fj9c-wr2v-556h covers the following CVE IDs: CVE-2026-90668. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-fj9c-wr2v-556h?

GHSA-fj9c-wr2v-556h has a CVSS v3 base score of 7.5, published by GitHub Security Advisories.

GHSA-fj9c-wr2v-556hHighCVSS 7.5

The webserver in UnrealIRCd 6.0.5 through 6.2.6 before 6.2.7 does not limit the number of HTTP...

Vendor

GitHub Security Advisories

Published

September 13, 2026

Last Modified

September 13, 2026

🔗 CVE IDs covered (1)

CVE-2026-90668 →

📋 Description

The webserver in UnrealIRCd 6.0.5 through 6.2.6 before 6.2.7 does not limit the number of HTTP request headers, which allows remote attackers to cause a denial of service (memory consumption and unresponsive server) via an HTTP request with an unlimited number of headers, if a websocket or JSON-RPC listener is enabled (disabled by default).

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2026-90668
https://forums.unrealircd.org/viewtopic.php?t=9483
https://www.unrealircd.org
https://github.com/advisories/GHSA-fj9c-wr2v-556h