An unauthenticated remote denial of service vulnerability in UnrealIRCd versions 6.0.5 through 6.2.6 poses a significant availability risk to systems utilizing the optional websocket or JSON-RPC listeners.

The software fails to implement limits on the number of HTTP request headers, allowing an attacker to trigger memory exhaustion and server unresponsiveness. This vulnerability is accessible to unauthenticated remote attackers specifically when the websocket or JSON-RPC listeners are enabled.

Successful exploitation results in a denial of service, rendering the IRC server unresponsive to legitimate traffic. Given the CVSS score of 7.5, this high-severity flaw can cause significant operational disruption for organizations relying on UnrealIRCd for real-time communication, potentially leading to reputational damage and loss of service availability.

Immediate Action: Upgrade to UnrealIRCd version 6.2.7 or later. Alternatively, administrators can apply the provided hot-patch by executing the command: ./unrealircd hot-patch webserver-header-dos.

Proactive Monitoring: Monitor server memory usage and review HTTP access logs for requests containing an unusually high volume of headers or anomalous patterns targeting the websocket or JSON-RPC endpoints.

Compensating Controls: Disable the websocket and JSON-RPC listeners if they are not required for your environment. Deploy a Web Application Firewall or load balancer to inspect and limit the number of headers allowed in incoming HTTP requests.

Public Exploit Available: Unknown

The vulnerability presents a clear risk to service availability for any deployment with the affected listeners enabled. Organizations should prioritize patching to version 6.2.7 or applying the vendor-supplied hot-patch immediately to remediate the resource exhaustion vector and ensure continued system stability.