GNU Bash through 4.3 bash43-026 does not properly parse function definitions in the values of environment variables, which allows remote attackers to execute arbitrary code or cause a denial of service (uninitialized memory access, and untrusted-pointer read and write operations) via a crafted environment, as demonstrated by vectors involving the ForceCommand feature in OpenSSH sshd, the mod_cgi and mod_cgid modules in the Apache HTTP Server, scripts executed by unspecified DHCP clients, and other situations in which setting the environment occurs across a privilege boundary from Bash execution. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-6271 and CVE-2014-7169.
CVSS Details
- CVSS 3.1 Base Score: 9.8
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade bash | Aug 30, 2017 | Sep 28, 2014 |
| Apple Osx Afpserver | — | Apply Apple macOS Security Update 2015-001 | Aug 28, 2015 | Sep 27, 2014 |
| Apple Osx Bash | — | Upgrade macOS to the latest version | Mar 29, 2016 | Sep 27, 2014 |
| Cisco Ise | — | — | Oct 21, 2025 | Sep 26, 2014 |
| Cisco Xe | — | Upgrade to the latest version of Cisco IOS XE | Jul 30, 2019 | Sep 27, 2014 |
| Debian | — | Upgrade bash | Jul 30, 2024 | Sep 27, 2014 |
| F5 Big Ip | — | Update F5 BIG-IP to the latest version | Jun 17, 2026 | May 22, 2015 |
| Freebsd | — | Upgrade bashUpgrade bash-static | Dec 10, 2025 | Oct 1, 2014 |
| Gentoo Linux | — | Upgrade app-shells/bash. | Oct 30, 2017 | Sep 27, 2014 |
| Gnu Bash | — | Upgrade to the latest version of GNU bash | Sep 30, 2014 | Sep 27, 2014 |
| Hpsim | — | Upgrade to the latest version of HP Systems Insight Manager | Oct 13, 2015 | Sep 27, 2014 |
| Oracle Solaris | — | Upgrade shell/bash to version 4.1.17-0.175.2.5.0.2.0 on Solaris 11.2 | May 29, 2017 | Sep 27, 2014 |
| Oracle_linux | — | Upgrade bashUpgrade bash-doc | Oct 16, 2024 | Sep 27, 2014 |
| Pulse Secure Pulse Connect Secure | — | Update Pulse Connect Secure to version 7.4R13.1Update Pulse Connect Secure to version 7.1R20.1Update Pulse Connect Secure to version 8.0R7 | Oct 28, 2020 | Sep 27, 2014 |
| Suse | — | Upgrade bash-langUpgrade readline-devel-32bitUpgrade bashUpgrade bash-x86Upgrade bash-develUpgrade bash-docUpgrade sles12sp1-docker-imageUpgrade libreadline6-32bitUpgrade readline-docUpgrade libreadline5-x86Upgrade sles12-docker-imageUpgrade libreadline5-32bitUpgrade libreadline5Upgrade libreadline7Upgrade readline-develUpgrade libreadline6 | Dec 18, 2015 | Sep 27, 2014 |
| Ubuntu | — | Upgrade bash | Nov 8, 2024 | Sep 27, 2014 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub