The redirection implementation in parse.y in GNU Bash through 4.3 bash43-026 allows remote attackers to cause a denial of service (out-of-bounds array access and application crash) or possibly have unspecified other impact via crafted use of here documents, aka the "redir_stack" issue.
CVSS Details
- CVSS 3.1 Base Score: 9.8
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade bash | Aug 30, 2017 | Sep 28, 2014 |
| Apple Osx Afpserver | — | Apply Apple macOS Security Update 2015-001 | Aug 28, 2015 | Sep 28, 2014 |
| Apple Osx Bash | — | Upgrade macOS to the latest version | Mar 29, 2016 | Sep 28, 2014 |
| Centos_linux | — | Upgrade bashUpgrade bash-doc | Dec 1, 2016 | Sep 28, 2014 |
| Cisco Ise | — | — | Oct 21, 2025 | Sep 26, 2014 |
| Cisco Xe | — | Upgrade to the latest version of Cisco IOS XE | Jul 30, 2019 | Sep 28, 2014 |
| Debian | — | Upgrade bash | Jul 30, 2024 | Sep 28, 2014 |
| F5 Big Ip | — | Update F5 BIG-IP to the latest version | Jun 17, 2026 | May 22, 2015 |
| Freebsd | — | Upgrade bashUpgrade bash-static | Dec 10, 2025 | Oct 1, 2014 |
| Gentoo Linux | — | Upgrade app-shells/bash. | Oct 30, 2017 | Sep 28, 2014 |
| Gnu Bash | — | Upgrade to the latest version of GNU bash | Sep 30, 2014 | Sep 25, 2014 |
| Hpsim | — | Upgrade to the latest version of HP Systems Insight Manager | Oct 13, 2015 | Sep 28, 2014 |
| Oracle Solaris | — | Upgrade shell/bash to version 4.1.17-0.175.2.5.0.2.0 on Solaris 11.2 | May 29, 2017 | Sep 28, 2014 |
| Oracle_linux | — | Upgrade bash-docUpgrade bash | Oct 16, 2024 | Sep 28, 2014 |
| Pulse Secure Pulse Connect Secure | — | Update Pulse Connect Secure to version 8.0R7Update Pulse Connect Secure to version 7.1R20.1Update Pulse Connect Secure to version 7.4R13.1 | Oct 28, 2020 | Sep 28, 2014 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Sep 25, 2014 |
| Suse | — | Upgrade readline-docUpgrade libreadline5Upgrade bash-docUpgrade bash-langUpgrade libreadline6-32bitUpgrade libreadline7Upgrade libreadline5-32bitUpgrade readline-devel-32bitUpgrade bashUpgrade libreadline6Upgrade libreadline5-x86Upgrade bash-develUpgrade bash-x86Upgrade readline-devel | Dec 18, 2015 | Sep 28, 2014 |
| Ubuntu | — | Upgrade bash | Nov 8, 2024 | Sep 28, 2014 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub