---
title: 'OpenSSH "regreSSHion" remote code execution (CVE-2024-6387)'
summary: >-
  A signal-handler race condition in OpenSSH's server (sshd) can allow
  unauthenticated remote code execution as root on glibc-based Linux systems.
  Patch or mitigate all internet-facing SSH servers.
severity: high
status: active
advisoryId: GARNET-CSIRT-2026-001
published: 2026-07-29
affected:
  - 'OpenSSH 8.5p1 – 9.7p1 on glibc-based Linux'
  - 'OpenSSH < 4.4p1 (unless patched for CVE-2006-5051 / CVE-2008-4109)'
cves:
  - CVE-2024-6387
tags:
  - ssh
  - remote-code-execution
  - linux
tlp: CLEAR
references:
  - title: 'Qualys advisory: regreSSHion (CVE-2024-6387)'
    url: 'https://www.qualys.com/2024/07/01/cve-2024-6387/regresshion.txt'
  - title: 'NVD — CVE-2024-6387'
    url: 'https://nvd.nist.gov/vuln/detail/CVE-2024-6387'
---

## Summary

Researchers disclosed a race condition in OpenSSH's `sshd` that can lead to
**unauthenticated remote code execution with root privileges** on glibc-based
Linux systems. Exploitation is difficult and requires many connection attempts,
but the impact — full server compromise — makes this a priority for any host
exposing SSH to untrusted networks.

## Who is affected

Any GARNET member operating a Linux server with an internet-reachable `sshd` in
the affected version range. Hosts behind strict network controls that restrict
SSH to known management networks are at substantially lower risk, but should
still be patched.

## Recommended actions

1. **Update OpenSSH** to a fixed release (9.8p1 or later), or apply your
   distribution's backported patch. On Debian/Ubuntu:
   `sudo apt update && sudo apt install --only-upgrade openssh-server`.
2. **Restrict exposure.** Limit SSH to trusted source networks with a firewall
   or security group, and prefer a bastion/jump host over direct exposure.
3. **Mitigate if you cannot patch immediately.** Setting `LoginGraceTime 0` in
   `sshd_config` removes the race window, but note it enables a denial-of-service
   condition — treat it as a temporary measure only.
4. **Restart `sshd`** after updating and confirm the running version with
   `ssh -V` and `sshd -V`.

## Reporting

If you believe a server in the community has been compromised via this issue,
[report an incident](/report/) to GARNET CSIRT immediately.