Description
A security regression (CVE-2006-5051) was discovered in OpenSSH's server (sshd). There is a race condition which can lead sshd to handle some signals in an unsafe manner. An unauthenticated, remote attacker may be able to trigger it by failing to authenticate within a set time period.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | OpenSSH | 8.5p1 – ≤ 9.7p1 | — |
| Red Hat | Red Hat Enterprise Linux 9 | — | — |
| Red Hat | Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions | — | — |
| Red Hat | Red Hat Enterprise Linux 9.2 Extended Update Support | — | — |
| Red Hat | Red Hat OpenShift Container Platform 4.13 | — | — |
| Red Hat | Red Hat OpenShift Container Platform 4.14 | — | — |
| Red Hat | Red Hat OpenShift Container Platform 4.15 | — | — |
| Red Hat | Red Hat OpenShift Container Platform 4.16 | — | — |
| Red Hat | Red Hat Ceph Storage 5 | — | — |
| Red Hat | Red Hat Ceph Storage 6 | — | — |
| Red Hat | Red Hat Ceph Storage 7 | — | — |
| Red Hat | Red Hat Enterprise Linux 10 | — | — |
| Red Hat | Red Hat Enterprise Linux 6 | — | — |
| Red Hat | Red Hat Enterprise Linux 7 | — | — |
| Red Hat | Red Hat Enterprise Linux 8 | — | — |
| Red Hat | Red Hat OpenShift Container Platform 4 | — | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | openssh | 1:9.7p1-7 | — |
| Debian 13 | openssh | 1:9.7p1-7 | — |
| Debian 12 | openssh | 1:9.2p1-2+deb12u3 | DSA-5724-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 24.04 LTS | openssh | 1:9.6p1-3ubuntu13.3 | USN-6859-1 |
| Ubuntu 22.04 LTS | openssh | 1:8.9p1-3ubuntu0.10 | USN-6859-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 9 | openssh +4 | 8.7p1-38.el9_4.1 | RHSA-2024:4312 |
| RHEL 9 | pam_ssh_agent_auth | 0.10.4-5.38.el9_4.1 | RHSA-2024:4312 |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 9.2 EUS | openssh +4 | 8.7p1-30.el9_2.4 | RHSA-2024:4340 |
| RHEL 9.2 EUS | pam_ssh_agent_auth | 0.10.4-5.30.el9_2.4 | RHSA-2024:4340 |
| RHEL 9.0 E4S | openssh +4 | 8.7p1-12.el9_0.1 | RHSA-2024:4389 |
| RHEL 9.0 E4S | pam_ssh_agent_auth | 0.10.4-4.12.el9_0.1 | RHSA-2024:4389 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 9 | openssh +4 | 8.7p1-38.el9_4.1 | ALSA-2024:4312 |
| AlmaLinux 9 | pam_ssh_agent_auth | 0.10.4-5.38.el9_4.1 | ALSA-2024:4312 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP6 | openssh +1 | 9.6p1-150600.6.3.1 | SUSE-SU-2024:2275-1 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLE Micro 6.0 | openssh | 9.6p1-2.1 | SUSE-SU-2025:20009-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | openssh | 9.6p1-10.1 | openSUSE-SU-2024:14088-1 |
| openSUSE Leap 15.6 | openssh +1 | 9.6p1-150600.6.3.1 | SUSE-SU-2024:2275-2, SUSE-SU-2024:2275-1 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | openssh | 9.8_p1-r0 | — |
| Alpine v3.23 | openssh | 9.8_p1-r0 | — |
| Alpine v3.22 | openssh | 9.8_p1-r0 | — |
| Alpine v3.21 | openssh | 9.8_p1-r0 | — |
| Alpine v3.20 | openssh | 9.7_p1-r4 | — |
Show 3 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.19 | openssh | 9.6_p1-r1 | — |
| Alpine v3.18 | openssh | 9.3_p2-r2 | — |
| Alpine v3.17 | openssh | 9.1_p1-r6 | — |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2023 | openssh +3 | 8.7p1-8.amzn2023.0.11 | ALAS2023-2024-649 |
| Amazon Linux 2023 | pam_ssh_agent_auth | 0.10.4-4.8.amzn2023.0.11 | ALAS2023-2024-649 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | openssh | 9.8p1-1 | — |
| Azure Linux 2 (CBL-Mariner) | openssh | 8.9p1-6 | — |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 9 | openssh +4 | 8.7p1-38.0.2.el9 | ELSA-2024-12468, ELSA-2024-4312 |
| Oracle Linux 9 | pam_ssh_agent_auth | 0.10.4-5.38.0.2.el9 | ELSA-2024-12468, ELSA-2024-4312 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Exploit-DB 1
- OpenSSH server (sshd) 9.8p1 - Race Condition EDB-52269 · remote · Apr 22, 2025
GitHub 97 repositories · most starred shown
-
xaitax/CVE-2024-6387_Check ★ 527 · Jul 1, 2024
CVE-2024-6387_Check is a lightweight, efficient tool designed to identify servers running vulnerable versions of OpenSSH
-
zgzhang/cve-2024-6387-poc ★ 497 · Jul 1, 2024
a signal handler race condition in OpenSSH's server (sshd)
-
acrono/cve-2024-6387-poc ★ 375 · Jul 1, 2024
32-bit PoC for CVE-2024-6387 — mirror of the original 7etsuo/cve-2024-6387-poc
-
Karmakstylez/CVE-2024-6387 ★ 200 · Jul 8, 2024
Remote Unauthenticated Code Execution Vulnerability in OpenSSH server (CVE-2024-6387)
-
lflare/cve-2024-6387-poc ★ 129 · Jul 1, 2024
MIRROR of the original 32-bit PoC for CVE-2024-6387 "regreSSHion" by 7etsuo/cve-2024-6387-poc
-
l0n3m4n/CVE-2024-6387 ★ 115 · Jul 2, 2024
PoC - Remote Unauthenticated Code Execution Vulnerability in OpenSSH server (Scanner and Exploit)
-
filipi86/CVE-2024-6387-Vulnerability-Checker ★ 103 · Jul 9, 2024
This Python script checks for the CVE-2024-6387 vulnerability in OpenSSH servers. It supports multiple IP addresses, URLs, CIDR ranges, and ports. The script can also read addresses from a file.
-
xonoxitron/regreSSHion ★ 71 · Jul 2, 2024
CVE-2024-6387 (regreSSHion) Exploit (PoC), a vulnerability in OpenSSH's server (sshd) on glibc-based Linux systems.
-
d0rb/CVE-2024-6387 ★ 53 · Jul 2, 2024
This Python script exploits a remote code execution vulnerability (CVE-2024-6387) in OpenSSH.
-
bigb0x/CVE-2024-6387 ★ 35 · Jul 1, 2024
Bulk Scanning Tool for OpenSSH CVE-2024-6387, CVE-2006-5051 , CVE-2008-4109 and others.
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 36
- ALSA-2024:4312 Important: openssh security update AlmaLinux Security Advisories · Oct 29, 2026
- RHSA-2024:4389 Red Hat Security Advisory: openssh security update Red Hat Security Advisories (RHSA) · Oct 15, 2026
- RHSA-2024:4340 Red Hat Security Advisory: openssh security update Red Hat Security Advisories (RHSA) · Oct 15, 2026
- RHSA-2024:4312 Red Hat Security Advisory: openssh security update Red Hat Security Advisories (RHSA) · Oct 15, 2026
- SSA-082556 SSA-082556: Vulnerabilities in the additional GNU/Linux subsystem of the SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP V3.1.5 Siemens ProductCERT · Oct 13, 2026
- WID-SEC-2024-1486 OpenSSH: Schwachstelle ermöglicht Codeausführung BSI CERT-Bund (WID) · Sep 15, 2026
- WID-SEC-2024-3195 Oracle Communications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Aug 11, 2026
- ICSA-25-162-05 Siemens SIMATIC S7-1500 CPU family CISA ICS & IT advisories · May 14, 2026
- WID-SEC-2026-1208 Oracle Systems: Mehrere Schwachstellen BSI CERT-Bund (WID) · Apr 22, 2026
- SUSE-SU-2025:20009-1 Security update for openssh SUSE / openSUSE Security Updates · Mar 23, 2026
- DSA-5724-1 openssh - security update Debian Security (DSA / DLA) · Mar 9, 2026
- USN-6859-1 openssh vulnerability Ubuntu Security Notices (USN) · Feb 10, 2026
- openSUSE-SU-2024:14088-1 openssh-9.6p1-10.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2024:2275-1 Security update for openssh SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2024:2275-2 Security update for openssh SUSE / openSUSE Security Updates · Feb 4, 2026
- WID-SEC-2024-1725 Apple macOS: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jan 11, 2026
- ICSA-24-256-15 Siemens Industrial Products CISA ICS & IT advisories · Jul 8, 2025
- SSA-446545 SSA-446545: Impact of RegreSSHion (CVE-2024-6387) in Siemens Industrial Products Siemens ProductCERT · Jul 8, 2025
- NCSC-2025-0187 Kwetsbaarheden verholpen in Siemens producten NCSC-NL (Netherlands) · Jun 10, 2025
- VDE-2024-071 Phoenix Contact: Multiple Vulnerabilities in PLCnext Firmware CERT@VDE · May 22, 2025
- VDE-2024-051 Phoenix Contact: Multiple mGuard devices are vulnerable to a remote code injection due to SSH CERT@VDE · May 14, 2025
- VDE-2024-044 Helmholz: Multiple products are vulnerable to regreSSHion CERT@VDE · May 14, 2025
- VDE-2024-063 PEPPERL+FUCHS: Multiple products are affected by regreSSHion CERT@VDE · May 14, 2025
- NCSC-2025-0166 Kwetsbaarheden verholpen in Fortinet producten NCSC-NL (Netherlands) · May 14, 2025
- VDE-2024-040 Multiple TRUMPF products prone to regreSSHion OpenSSH server vulnerabilities CERT@VDE · Apr 10, 2025
- 2NGA002427 ABB Arctic ARG600, ARC600, ARR600, ARP600 Arctic Wireless Gateway Modem Module and OpenSSH vulnerabilities ABB PSIRT · Apr 7, 2025
- ICSA-25-100-09 ABB Arctic Wireless Gateways CISA ICS & IT advisories · Apr 7, 2025
- NCSC-2024-0414 Kwetsbaarheden verholpen in Oracle Communications NCSC-NL (Netherlands) · Oct 17, 2024
- NCSC-2024-0362 Kwetsbaarheden verholpen in Siemens producten NCSC-NL (Netherlands) · Sep 10, 2024
- VDE-2024-043 Welotec: Multiple products are vulnerable to regreSSHion CERT@VDE · Aug 22, 2024
- NCSC-2024-0320 Kwetsbaarheden verholpen in Apple MacOS NCSC-NL (Netherlands) · Jul 30, 2024
- ELSA-2024-4312 Important: openssh security update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Jul 4, 2024
- NCSC-2024-0272 Kwetsbaarheid verholpen in OpenSSH NCSC-NL (Netherlands) · Jul 1, 2024
- ALAS2023-2024-649 Important: openssh security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Jul 1, 2024
- ELSA-2024-12468 Important: openssh security update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Jul 1, 2024
- VDE-2024-042 MB connect line: Multiple products are vulnerable to regreSSHion CERT@VDE · Aug 17, 2023
References
- RHSA-2024:4312 vendor-advisory
- RHSA-2024:4340 vendor-advisory
- RHSA-2024:4389 vendor-advisory
- RHSA-2024:4469 vendor-advisory
- RHSA-2024:4474 vendor-advisory
- RHSA-2024:4479 vendor-advisory
- RHSA-2024:4484 vendor-advisory
- https://access.redhat.com/security/cve/CVE-2024-6387 vdb-entry
- RHBZ#2294604 issue-tracking
- https://santandersecurityresearch.github.io/blog/sshing_the_masses.html
- https://www.openssh.com/txt/release-9.8
- https://www.qualys.com/2024/07/01/cve-2024-6387/regresshion.txt