GNU Bash through 4.3 bash43-026 does not properly parse function definitions in the values of environment variables, which allows remote attackers to execute arbitrary commands via a crafted environment, as demonstrated by vectors involving the ForceCommand feature in OpenSSH sshd, the mod_cgi and mod_cgid modules in the Apache HTTP Server, scripts executed by unspecified DHCP clients, and other situations in which setting the environment occurs across a privilege boundary from Bash execution. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-6271, CVE-2014-7169, and CVE-2014-6277.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade bash | Aug 30, 2017 | Sep 28, 2014 |
| Cisco Ise | — | — | Oct 21, 2025 | Sep 26, 2014 |
| Cisco Xe | — | Upgrade to the latest version of Cisco IOS XE | Jul 30, 2019 | Sep 30, 2014 |
| Debian | — | Upgrade bash | Jul 30, 2024 | Sep 30, 2014 |
| F5 Big Ip | — | Update F5 BIG-IP to the latest version | Jun 17, 2026 | May 22, 2015 |
| Freebsd | — | Upgrade bashUpgrade bash-static | Dec 10, 2025 | Oct 1, 2014 |
| Gentoo Linux | — | Upgrade app-shells/bash. | Oct 30, 2017 | Sep 30, 2014 |
| Gnu Bash | — | Upgrade to the latest version of GNU bash | Sep 30, 2014 | Sep 30, 2014 |
| Oracle Solaris | — | Upgrade shell/bash to version 4.1.17-0.175.2.5.0.2.0 on Solaris 11.2 | May 29, 2017 | Sep 30, 2014 |
| Oracle_linux | — | Upgrade bash-docUpgrade bash | Oct 16, 2024 | Sep 30, 2014 |
| Pulse Secure Pulse Connect Secure | — | Update Pulse Connect Secure to version 8.0R7Update Pulse Connect Secure to version 7.4R13.1Update Pulse Connect Secure to version 7.1R20.1 | Oct 28, 2020 | Sep 30, 2014 |
| Suse | — | Upgrade libreadline6-32bitUpgrade bashUpgrade bash-develUpgrade sles12sp1-docker-imageUpgrade bash-x86Upgrade readline-docUpgrade sles12-docker-imageUpgrade readline-devel-32bitUpgrade libreadline5-x86Upgrade libreadline7Upgrade bash-docUpgrade readline-develUpgrade bash-langUpgrade libreadline6Upgrade libreadline5Upgrade libreadline5-32bit | Dec 18, 2015 | Sep 30, 2014 |
| Ubuntu | — | Upgrade bash | Nov 8, 2024 | Sep 30, 2014 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub