GNU Bash through 4.3 bash43-026 does not properly parse function definitions in the values of environment variables, which allows remote attackers to execute arbitrary code or cause a denial of service (uninitialized memory access, and untrusted-pointer read and write operations) via a crafted environment, as demonstrated by vectors involving the ForceCommand feature in OpenSSH sshd, the mod_cgi and mod_cgid modules in the Apache HTTP Server, scripts executed by unspecified DHCP clients, and other situations in which setting the environment occurs across a privilege boundary from Bash execution. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-6271 and CVE-2014-7169.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade bash | Aug 30, 2017 | Sep 28, 2014 |
| Apple Osx Afpserver | — | Apply Apple macOS Security Update 2015-001 | Aug 28, 2015 | Sep 27, 2014 |
| Apple Osx Bash | — | Upgrade macOS to the latest version | Mar 29, 2016 | Sep 27, 2014 |
| Cisco Ise | — | — | Oct 21, 2025 | Sep 26, 2014 |
| Cisco Xe | — | Upgrade to the latest version of Cisco IOS XE | Jul 30, 2019 | Sep 27, 2014 |
| Debian | — | Upgrade bash | Jul 30, 2024 | Sep 27, 2014 |
| F5 Big Ip | — | Update F5 BIG-IP to the latest version | Jun 17, 2026 | May 22, 2015 |
| Freebsd | — | Upgrade bashUpgrade bash-static | Dec 10, 2025 | Oct 1, 2014 |
| Gentoo Linux | — | Upgrade app-shells/bash. | Oct 30, 2017 | Sep 27, 2014 |
| Gnu Bash | — | Upgrade to the latest version of GNU bash | Sep 30, 2014 | Sep 27, 2014 |
| Hpsim | — | Upgrade to the latest version of HP Systems Insight Manager | Oct 13, 2015 | Sep 27, 2014 |
| Oracle Solaris | — | Upgrade shell/bash to version 4.1.17-0.175.2.5.0.2.0 on Solaris 11.2 | May 29, 2017 | Sep 27, 2014 |
| Oracle_linux | — | Upgrade bash-docUpgrade bash | Oct 16, 2024 | Sep 27, 2014 |
| Pulse Secure Pulse Connect Secure | — | Update Pulse Connect Secure to version 8.0R7Update Pulse Connect Secure to version 7.4R13.1Update Pulse Connect Secure to version 7.1R20.1 | Oct 28, 2020 | Sep 27, 2014 |
| Suse | — | Upgrade libreadline6Upgrade libreadline5Upgrade libreadline5-32bitUpgrade libreadline7Upgrade readline-develUpgrade bash-docUpgrade bash-x86Upgrade bash-develUpgrade sles12sp1-docker-imageUpgrade sles12-docker-imageUpgrade libreadline5-x86Upgrade readline-devel-32bitUpgrade bash-langUpgrade bashUpgrade libreadline6-32bitUpgrade readline-doc | Dec 18, 2015 | Sep 27, 2014 |
| Ubuntu | — | Upgrade bash | Nov 8, 2024 | Sep 27, 2014 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub