UnrealIRCd Webserver Accepts Unlimited HTTP Headers, Enabling Remote Denial of Service

The webserver in UnrealIRCd 6.0.5 through 6.2.6 before 6.2.7 does not limit the number of HTTP request headers, which allows remote attackers to cause a denial of service (memory consumption and unresponsive server) via an HTTP request with an unlimited number of headers, if a websocket or JSON-RPC listener is enabled (disabled by default).

• The structured affected data identifies the UnrealIRCd webserver as affected from 6.0.5 to before 6.2.7, which corresponds to 6.0.5 through 6.2.6 in the description.
• Exploitation requires a websocket listener or JSON-RPC listener to be enabled; both are disabled by default, so the default status is recorded as unaffected.
• The available evidence does not independently establish an additional parallel release branch or another affected product.

This is a CWE-770 resource-allocation flaw because the webserver does not limit the number of HTTP request headers it accepts. The affected component is UnrealIRCd's webserver HTTP-header handling, with the number of headers controlled by the attacker. A remote HTTP client can send a request to the listener without authentication; when a websocket or JSON-RPC listener is enabled, processing an unlimited number of headers can consume memory and leave the IRCd unresponsive. Both listeners are disabled by default, so that configuration condition must be checked separately. The available evidence does not identify the internal allocation path, the exhaustion threshold, or whether the resource impact is isolated per connection.

• The issue is network reachable through an HTTP request sent to an enabled websocket or JSON-RPC listener in the webserver.
• The record describes a remote attacker requiring no authentication and no user interaction; the required precondition is that the relevant listener is enabled.
• The supplied assessment describes the attack complexity as low.
• The normalized record does not identify a public exploit. Observed exploitation status is not established because known_exploited has no confirming value.

The flaw allows a remote unauthenticated client to exhaust webserver memory and make the IRCd unresponsive when the relevant listener is enabled. The established technical outcome is denial of service affecting server availability, with no confidentiality or integrity impact described in the available evidence. No prior access or user interaction is required, but the server must expose a websocket or JSON-RPC listener. The record does not describe code execution, privilege escalation, data access, or data modification.

The primary consequence is loss of service availability because memory consumption can make the IRCd unresponsive. This can interrupt IRC operations and services that depend on the UnrealIRCd webserver. Deployments that do not enable the websocket or JSON-RPC listener do not meet the described exposure condition, but the live configuration must be verified. The supplied evidence describes an availability impact and does not describe data disclosure or data modification.

1. Upgrade to UnrealIRCd 6.2.7 or later, as stated in the supplied solution. The project notice says the complete 6.2.7 release includes webserver fixes; on *NIX, the full upgrade procedure requires a restart.
2. If an immediate restart is not possible, apply the official webserver-header-dos hot-patch with ./unrealircd hot-patch webserver-header-dos. The vendor notice says the hot-patch updates UnrealIRCd 6.2.x without a restart and may also work on older unsupported versions; "may" is not a support guarantee for those versions.
3. If patching must be delayed, disable the websocket and JSON-RPC listeners when they are not required. This is a temporary risk-reduction measure inferred from the stated exposure condition and should not replace updating.
4. After remediation, verify the actual running version, hot-patch status, and listener configuration. The hot-patch addresses the stated issues, while the complete release also contains other fixes and enhancements.

1. Inventory UnrealIRCd installations and verify the running version, especially versions from 6.0.5 through before 6.2.7.
2. Inspect configuration and deployment settings to determine whether a websocket listener or JSON-RPC listener is enabled. Both are disabled by default, but the default does not replace a check of the live configuration.
3. Monitor memory consumption and IRCd responsiveness on systems exposing the webserver. Treat these as operational symptoms, not as unique indicators of this vulnerability.
4. If telemetry records HTTP header counts, review requests with unusually high header counts. This is a precautionary analytic because the available evidence does not define a specific log event or detection signature.
5. After remediation, verify the running version or confirm that the hot-patch was applied, then recheck the relevant listener configuration.