CVE-2024-6387: Openssh: regresshion - race condition in ssh allows rce/dos

Is it exploited?

Reported, not confirmed by CISA. VulnCheck KEV lists it as exploited in the wild. CISA has not added it to its Known Exploited Vulnerabilities catalog as of 29 Oct 2026.

VulnCheck KEV lists it since 17 Jul 2024. It cites 5 public reports, the first from 17 Jul 2024.

• cadosecurity.com
• content.kaspersky-labs.com
• app.crowdsec.net

How likely is exploitation in the next 30 days?

99.5%

EPSS score, percentile 99.9 of all scored records. A probability estimated by FIRST, not a report of exploitation.

CISA's SSVC assessment in the CVE record lists exploitation as poc.

How severe?

8.1 High

CVSS v3.1 base score, given by the CNA

What should I do?

CISA has set no required action, because the vulnerability is not in KEV.

Advisories and patches (7)

Which versions are affected?

Unaffected 0:8.7p1-38.el9_4.1; 0:8.7p1-38.el9_4.1; 0:8.7p1-12.el9_0.1; 0:8.7p1-30.el9_2.4; 413.92.202407091321-0; 414.92.202407091253-0; and 2 more

Versions by product

Source: CISA KEV 2026.10.29, as of 29 Oct 2026; VulnCheck KEV, as of 30 Oct 2026; FIRST EPSS, as of 29 Oct 2026; CVE List, as of 30 Oct 2026. About the data.

Description

Openssh: regresshion - race condition in ssh allows rce/dos

A security regression (CVE-2006-5051) was discovered in OpenSSH's server (sshd). There is a race condition which can lead sshd to handle some signals in an unsafe manner. An unauthenticated, remote attacker may be able to trigger it by failing to authenticate within a set time period.

Source: CVE List, as of 30 Oct 2026. About the data.

What to do

Advisories and patches

• RHSA-2024:4312 (Vendor advisory)
• RHSA-2024:4340 (Vendor advisory)
• RHSA-2024:4389 (Vendor advisory)
• RHSA-2024:4469 (Vendor advisory)
• RHSA-2024:4474 (Vendor advisory)
• RHSA-2024:4479 (Vendor advisory)
• RHSA-2024:4484 (Vendor advisory)

Workaround (from the CVE record)

The below process can protect against a Remote Code Execution attack by disabling the LoginGraceTime parameter on Red Hat Enterprise Linux 9. However, the sshd server is still vulnerable to a Denial of Service if an attacker exhausts all the connections. 1) As root user, open the /etc/ssh/sshd_config 2) Add or edit the parameter configuration: ~~~ LoginGraceTime 0 ~~~ 3) Save and close the file 4) Restart the sshd daemon: ~~~ systemctl restart sshd.service ~~~ Setting LoginGraceTime to 0 disables the SSHD server's ability to drop connections if authentication is not completed within the specified timeout. If this mitigation is implemented, it is highly recommended to use a tool like 'fail2ban' alongside a firewall to monitor log files and manage connections appropriately. If any of the mitigations mentioned above is used, please note that the removal of LoginGraceTime parameter from sshd_config is not automatic when the updated package is installed.

This summary is based on the CVE record as of 30 Oct 2026. Check the vendor's advisory before you act: affected versions and fixes can change.

Affected products and versions

Source: CVE List, as of 30 Oct 2026. About the data.

Timeline

Known exploited Red Hat vulnerabilities

• CVE-2015-3246: Red Hat Libuser Race Condition Vulnerability (added 26 Aug 2026)
• CVE-2015-5287: Red Hat Automatic Bug Reporting Tool Privilege Escalation Vulnerability (added 26 Aug 2026)
• CVE-2018-14667: Red Hat JBoss RichFaces Framework Expression Language Injection Vulnerability (added 28 Sep 2023)
• CVE-2021-3560: Red Hat Polkit Incorrect Authorization Vulnerability (added 12 May 2023)
• CVE-2021-4034: Red Hat Polkit Out-of-Bounds Read and Write Vulnerability (added 27 Jun 2022)