CVEReports
CVEReports

Automated vulnerability intelligence platform. Comprehensive reports for high-severity CVEs generated by AI.

Product

  • Home
  • Sitemap
  • RSS Feed

Company

  • About
  • Contact
  • Privacy Policy
  • Terms of Service

© 2026 CVEReports. All rights reserved.

Made with love by Amit Schendel & Alon Barad

CVE-2008-4109

CVE-2008-4109: The Zombie Deadlock — When Logging Kills Your SSH Daemon

Amit Schendel
Amit Schendel
Senior Security Researcher

Jan 2, 2026·6 min read·33 visits

Executive Summary (TL;DR)

In 2008, multiple Linux distributions patched an OpenSSH vulnerability but accidentally introduced a deadlock condition. By calling `syslog()` inside a `SIGALRM` handler, `sshd` processes could hang indefinitely if interrupted while logging. Attackers could exhaust connection slots (`MaxStartups`), causing a total Denial of Service. This pattern resurfaced in 2024 as CVE-2024-6387, proving that dead code eventually comes back to bite.

A deep dive into a notorious signal handler race condition in OpenSSH that turns security logging into a Denial of Service weapon. This vulnerability highlights the perils of non-async-signal-safe functions and serves as the direct ancestor to the 2024 'regreSSHion' RCE.

Official Patches

UbuntuUbuntu Security Notice USN-649-1
DebianDebian Security Tracker

Technical Appendix

CVSS Score
7.8/ 10
CVSS:2.0/AV:N/AC:L/Au:N/C:N/I:N/A:C
EPSS Probability
0.34%
Top 99% most exploited

Affected Systems

Debian Etch (4.0)Debian Sid/LennyUbuntu 6.06 LTSUbuntu 7.10Ubuntu 8.04 LTSSUSE Linux Enterprise

Affected Versions Detail

Product
Affected Versions
Fixed Version
openssh-server
Debian
< 4.3p2-9etch34.3p2-9etch3
openssh-server
Canonical
Ubuntu 8.04 LTS < USN-649-1USN-649-1
AttributeDetail
CWE IDCWE-364 (Signal Handler Race Condition)
Attack VectorNetwork (AV:N)
CVSS Score7.8 (High)
ImpactDenial of Service (DoS) / Deadlock
Privileges RequiredNone (Pre-auth)
Exploit StatusProof of Concept Available

MITRE ATT&CK Mapping

T1498Network Denial of Service
Impact
T1499Endpoint Denial of Service
Impact
CWE-364
Signal Handler Race Condition

The software handles a signal in a way that causes the software to enter a state in which it is no longer responsive.

Known Exploits & Detection

ExploitDBOpenSSH (Debian/Ubuntu) - Denial of Service Exploit

Vulnerability Timeline

CVE-2006-5051 discovered (Original Signal Race)
2006-09-28
Distributions patch 2006-5051 but introduce deadlock (CVE-2008-4109)
2008-09-00
Public disclosure and fixes for CVE-2008-4109
2008-09-28
Qualys discloses regreSSHion (CVE-2024-6387), linking back to 2008-4109
2024-07-01

References & Sources

  • [1]Qualys Security Advisory: regreSSHion (Discusses history of 2008-4109)
  • [2]NVD - CVE-2008-4109
Related Vulnerabilities
CVE-2006-5051CVE-2024-6387

Attack Flow Diagram

Press enter or space to select a node. You can then use the arrow keys to move the node around. Press delete to remove it and escape to cancel.
Press enter or space to select an edge. You can then press delete to remove it or escape to cancel.

More Reports

•4 minutes ago•CVE-2026-56677
8.6

CVE-2026-56677: Unauthenticated Server-Side Request Forgery in 9Router OIDC Test Endpoint

A high-severity security vulnerability exists in 9Router, an AI router and token saver dashboard. When dashboard authentication features are disabled or left in default configurations, the application exposes administrative testing routines directly to the public internet. Unauthenticated network adversaries can exploit the OIDC configuration validation endpoint to initiate arbitrary HTTP requests, routing unauthorized traffic to local loops, adjacent container ports, and cloud resource metadata interfaces.

Amit Schendel
Amit Schendel
0 views•5 min read
•about 1 hour ago•CVE-2026-64849
9.3

CVE-2026-64849: Server-Side Request Forgery (SSRF) in MLflow Webhooks via DNS Rebinding

CVE-2026-64849 is a critical Server-Side Request Forgery (SSRF) vulnerability affecting MLflow tracking servers prior to version 3.15.0. It allows unauthenticated remote attackers to bypass outbound request destination filters using DNS rebinding or HTTP redirects. This exposure risks compromising sensitive cloud infrastructure metadata and internal microservices.

Alon Barad
Alon Barad
2 views•5 min read
•about 2 hours ago•CVE-2026-69146
6.5

CVE-2026-69146: Missing Authorization Bypass in MLflow Basic Authentication Middleware

This technical report details a missing authorization vulnerability (CVE-2026-69146 / GHSA-3p64-6gvh-82v5) affecting the MLflow platform from version 3.13.0 to 3.15.0. When MLflow is configured with the built-in basic-auth plugin, authenticated users can bypass run-level UPDATE authorization checks, enabling unauthorized dataset and model lineage metadata injection.

Alon Barad
Alon Barad
2 views•7 min read
•about 3 hours ago•CVE-2026-69148
7.1

CVE-2026-69148: Broken Object Level Authorization (BOLA) in MLflow Model Registry

MLflow prior to version 3.15.0 fails to perform proper authorization checks when registering model versions, allowing authenticated users with access to a registered model to link and access artifacts from runs and models belonging to other users without authorization.

Amit Schendel
Amit Schendel
4 views•7 min read
•about 4 hours ago•CVE-2026-59893
7.5

CVE-2026-59893: Regular Expression Denial of Service in sqlparse Lexer

A high-severity Regular Expression Denial of Service (ReDoS) vulnerability in the sqlparse Python library prior to version 0.6.0 allows unauthenticated remote attackers to trigger CPU exhaustion and application denial of service via crafted SQL inputs containing unmatched dollar-quoted literals or unclosed multiline comments.

Alon Barad
Alon Barad
4 views•6 min read
•about 5 hours ago•GHSA-FHGH-WQ4Q-R37X
7.8

GHSA-FHGH-WQ4Q-R37X: Remote Code Execution via Sigstore Signature Verification Bypass in uniget CLI

A high-severity logic inversion flaw in the uniget CLI completely bypasses Sigstore cryptographic signature verification on metadata files by default. If an attacker can poison the package metadata cache or repository, they can execute arbitrary OS commands under the privileges of the active user.

Alon Barad
Alon Barad
5 views•5 min read