[Blog](/blog) Show links Resources [Blog](/blog) [Breaches](/breaches) [eBooks, reports, & more](/resources) [Events](/events) [News](/news) [Risks and Vulnerabilities](/category/risks-and-vulnerabilities) Show links Categories [Attack Surface Management](/category/attack-surface-management) [Company News](/category/company-news) [Compliance and Regulations](/category/compliance-and-regulations) [Cybersecurity](/category/cybersecurity) [Data Breaches](/category/data-breaches) [DevOps](/category/devops) [Human Cyber Risk](/category/human-cyber-risk) [Risks and Vulnerabilities](/category/risks-and-vulnerabilities) [Third-Party Risk Management](/category/third-party-risk-management) [Vendor Risk Management](/category/vendor-risk-management) [How to Respond: OpenSSH Vulnerability CVE-2024-6387](/blog/openssh-vulnerability-cve-2024-6387) Publish date July 4, 2025 {x} minute read # How to Respond: OpenSSH Vulnerability CVE-2024-6387 [Get a demo](/contact-sales) [Free trial](/demo) [Download the PDF guide](/resources/complete-guide-to-data-breaches) [Free trial](/demo) Written by [Edward Kost](/team/edward-kost) Senior Cybersecurity Writer Edward is a cyber writer with a mechanical engineering background. His work has been referenced by academic institutions and government bodies. Reviewed by [Greg Pollock](/team/greg-pollock) Director of Research and Insights Greg is a CISA-certified cybersecurity researcher who holds multiple patents for data leak detection. His findings have been featured in The New York Times, Forbes, and Wired. Table of contents eBook A Complete Guide to Data Breaches Free resource ### A Complete Guide to Data Breaches Learn how to avoid a costly data breach with a comprehensive prevention strategy. [Download now](/resources/complete-guide-to-data-breaches) OpenSSH server is currently exposed to a dangerous vulnerability that, if exploited, could grant cybercriminals full system access without user interaction. This post provides an overview of CVE-2024-6387 and suggests remediation responses to mitigate its impact. ## What is CVE-2024-6387? CVE-2024-6387 is a vulnerability in OpenSSH servers (sshd) in 32-bit Linux/glibc systems. If exploited, the vulnerability facilitates Remote Code Execution with full root privileges, classifying it as a high-severity exposure ([CVSS 8.1](https://nvd.nist.gov/vuln/detail/CVE-2024-6387)). CVE-2024-6387 (discovered on 1 July 2024) isn't an entirely new exposure. It's a regression from a previously patched vulnerability CVE-2006-5051, first discovered in 2006 **(**hence the codename regreSSHion). At the heart of this issue is a signal-handler race condition vulnerability within the sshd process of OpenSSH servers, which facilitates code execution on impacted systems with the highest level of system privileges, root privileges. > A race condition is triggered when system operations occur out of order, disrupting a system's ideal end state. In this instance, the race condition is triggered because the sshd process on glibc-based Linux systems uses syslog() to asynchronously call functions like malloc() and free(), which are used to manage memory allocation.  "Malloc() is not safe to call asynchronously (eg. from signal handlers). Doing so results in a race-condition vulnerability making the malloc operation susceptible to interruption using SIGALRM, leaving the heap in an inconsistent exploitable state  Root privilege access is possible because sshd's privileged code, by design, runs with full privileges by default instead of being sandboxed. This design decision increases the OpenSSH server process's vulnerability to cyberattacks. Exploitation of CVE-2024-6387 requires a cyber attack design of reasonable complexity, requiring hackers to force a high volume of race conditions for an unknown period of time to achieve RCE, which explains the current lack of PoC code for this vulnerability in the wild. That being said, exploitation is still a possibility, and all impacted SSH servers must be updated immediately. Which OpenSSH versions are impacted? * Versions older than 4.4p1 (except those that are patched for [CVE-2006-5051](https://nvd.nist.gov/vuln/detail/CVE-2006-5051) and [CVE-2008-4109](https://nvd.nist.gov/vuln/detail/CVE-2008-4109)) * Versions 8.5p1 to 9.7p1 (inclusive) OpenBSD-based servers are not impacted by the OpenSSH regreSSHion vulnerability. ## Responding to CVE-2024-6387 The immediate course of action is to update impacted SSH servers to the latest version, 9.8p1 ([see OpenSSH release notes](https://www.openssh.com/releasenotes.html)). To circumvent any version update delays, admins can force an immediate update by temporarily setting the login timeout to zero (LoginGraceTime=0 in sshd\_config). Just keep in mind that this configuration could make SSH servers more vulnerable to DDoS attacks, so it should only be used as a temporary workaround if the risk is deemed acceptable.  Additional risk mitigation steps include: * Segregating internal networks to disrupt unauthorized access attempts to sensitive regions. * Implement triggers and monitoring solutions for suspicious internal activities. * Configuring your firewall to limit SSH access to certain IP addresses. ## How to detect CVE-2024-6387 With [UpGuard Breach Risk](https://www.upguard.com/product/breach-risk), you can identify whether your internal IT infrastructure is impacted by searching for CVE-2024-6387 in the detected vulnerabilities feed. To determine which of your third-party vendors are impacted by CVE-2024-638, search for it in the Portfolio Risk Profile within [UpGuard Vendor Risk](https://www.upguard.com/product/vendorrisk). Each detected instance of exposure to the OpenSSH regreSSHion can then instantly be progressed through remediation and risk management workflows natively integrated into UpGuard to form an all-in-one Vendor Risk Management solution eBook A Complete Guide to Data Breaches Free resource ### A Complete Guide to Data Breaches Learn how to avoid a costly data breach with a comprehensive prevention strategy. [Download now](/resources/complete-guide-to-data-breaches) ## Related posts Learn more about the latest issues in cybersecurity. Risks and Vulnerabilities #### [25 Security Vulnerabilities That Have Defined the 2020s (Thus Far)](/blog/top-25-security-vulnerabilities-of-the-2020s) From Log4j to SolarWinds, discover the 25 critical security vulnerabilities that have reshaped cybersecurity thus far in the 2020s. [](/team/nicholas-sollitto) [Nicholas Sollitto](#) May 28, 2026 Risks and Vulnerabilities #### [ServiceNow Vulnerabilities: CVE-2024-4789 and CVE-2024-5217](/blog/servicenow-vulnerabilities) Learn about two critical vulnerabilities affecting the ServiceNow platform (CVE-2024-4789 and CVE-2024-5217) and how UpGuard can help. [](/team/nicholas-sollitto) [Nicholas Sollitto](#) January 16, 2025 Risks and Vulnerabilities #### [PHP2Shell: A Clear Explanation and Response Framework](/blog/php2shell-a-clear-explanation-and-response-framework) PHP2Shell (CVE-2026-109618 and CVE-2026-109619) lets unauthenticated attackers run code on PHP servers. Learn who’s affected and how to respond. [](/team/upguard) [UpGuard Team](#) November 5, 2026 Risks and Vulnerabilities #### [Everything Everywhere: Systemic Data Exposure in Supabase Apps](/blog/everything-everywhere-systemic-data-exposure-in-supabase-apps) Supabase is a favorite of AI coding agents. It's also prone to misconfiguration. We studied more than 16,000 open databases to see what's leaking. [](/team/greg-pollock) [Greg Pollock](#) October 14, 2026 Risks and Vulnerabilities #### [Oracle Just Shipped 1,449 Security Patches in One Quarter. We Checked How Much of It Is Actually New.](/blog/oracle-just-shipped-1-449-security-patches-in-one-quarter-we-checked-how-much-of-it-is-actually-new) Oracle's July 2026 update shipped 1,449 security patches — 2.8x its all-time record. We parsed 23 quarters of advisories to find out how much is truly new. [](/team/greg-pollock) [Greg Pollock](#) July 22, 2026 Risks and Vulnerabilities #### [Data leakage risks with DBHub MCP servers](/blog/data-leakage-risks-with-dbhub-mcp-servers) UpGuard found exposed DBHub servers leaking live databases to the open internet—an early sign that MCP exposure is becoming a systemic data risk. [](/team/greg-pollock) [Greg Pollock](#) October 13, 2026 [All posts](/blog) Experience superior visibility and a simpler approach to cyber risk management [Get a demo](/contact-sales) [Free trial](/demo)