GNU Bash through 4.3 bash43-026 does not properly parse function definitions in the…
Priority HIGH 78CWE-78Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- — Not recorded in CVSS 2.0
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- Complete · Complete · Complete
- Fix status
- No fix listed
Attack profile from CVSS 2.0 · NVD. Fix status from CNA. Impact type from CWE-78.
Summary
GNU Bash through 4.3 bash43-026 does not properly parse function definitions in the values of environment variables, which allows remote attackers to execute arbitrary code or cause a denial of service (uninitialized memory access, and untrusted-pointer read and write operations) via a crafted environment, as demonstrated by vectors involving the ForceCommand feature in OpenSSH sshd, the mod_cgi and mod_cgid modules in the Apache HTTP Server, scripts executed by unspecified DHCP clients, and other situations in which setting the environment occurs across a privilege boundary from Bash execution. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-6271 and CVE-2014-7169.
Why it matters now
EPSS 0.64326 99th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix No fix listed No fixed version in the sources yet
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
CPE configurations NVD · 28
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:gnu:bash:1.14.0:*:*:*:*:*:*:* | 1.14.0 | Vulnerable | GNU |
| cpe:2.3:a:gnu:bash:1.14.1:*:*:*:*:*:*:* | 1.14.1 | Vulnerable | GNU |
| cpe:2.3:a:gnu:bash:1.14.2:*:*:*:*:*:*:* | 1.14.2 | Vulnerable | GNU |
| cpe:2.3:a:gnu:bash:1.14.3:*:*:*:*:*:*:* | 1.14.3 | Vulnerable | GNU |
| cpe:2.3:a:gnu:bash:1.14.4:*:*:*:*:*:*:* | 1.14.4 | Vulnerable | GNU |
| cpe:2.3:a:gnu:bash:1.14.5:*:*:*:*:*:*:* | 1.14.5 | Vulnerable | GNU |
| cpe:2.3:a:gnu:bash:1.14.6:*:*:*:*:*:*:* | 1.14.6 | Vulnerable | GNU |
| cpe:2.3:a:gnu:bash:1.14.7:*:*:*:*:*:*:* | 1.14.7 | Vulnerable | GNU |
| cpe:2.3:a:gnu:bash:2.0:*:*:*:*:*:*:* | 2.0 | Vulnerable | GNU |
| cpe:2.3:a:gnu:bash:2.01:*:*:*:*:*:*:* | 2.01 | Vulnerable | GNU |
- cpe:2.3:a:gnu:bash:1.14.0:*:*:*:*:*:*:* Versions 1.14.0 Vulnerable ·GNU
- cpe:2.3:a:gnu:bash:1.14.1:*:*:*:*:*:*:* Versions 1.14.1 Vulnerable ·GNU
- cpe:2.3:a:gnu:bash:1.14.2:*:*:*:*:*:*:* Versions 1.14.2 Vulnerable ·GNU
- cpe:2.3:a:gnu:bash:1.14.3:*:*:*:*:*:*:* Versions 1.14.3 Vulnerable ·GNU
- cpe:2.3:a:gnu:bash:1.14.4:*:*:*:*:*:*:* Versions 1.14.4 Vulnerable ·GNU
- cpe:2.3:a:gnu:bash:1.14.5:*:*:*:*:*:*:* Versions 1.14.5 Vulnerable ·GNU
- cpe:2.3:a:gnu:bash:1.14.6:*:*:*:*:*:*:* Versions 1.14.6 Vulnerable ·GNU
- cpe:2.3:a:gnu:bash:1.14.7:*:*:*:*:*:*:* Versions 1.14.7 Vulnerable ·GNU
- cpe:2.3:a:gnu:bash:2.0:*:*:*:*:*:*:* Versions 2.0 Vulnerable ·GNU
- cpe:2.3:a:gnu:bash:2.01:*:*:*:*:*:*:* Versions 2.01 Vulnerable ·GNU
Show 18 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:gnu:bash:2.01.1:*:*:*:*:*:*:* | 2.01.1 | Vulnerable | GNU |
| cpe:2.3:a:gnu:bash:2.02:*:*:*:*:*:*:* | 2.02 | Vulnerable | GNU |
| cpe:2.3:a:gnu:bash:2.02.1:*:*:*:*:*:*:* | 2.02.1 | Vulnerable | GNU |
| cpe:2.3:a:gnu:bash:2.03:*:*:*:*:*:*:* | 2.03 | Vulnerable | GNU |
| cpe:2.3:a:gnu:bash:2.04:*:*:*:*:*:*:* | 2.04 | Vulnerable | GNU |
| cpe:2.3:a:gnu:bash:2.05:*:*:*:*:*:*:* | 2.05 | Vulnerable | GNU |
| cpe:2.3:a:gnu:bash:2.05:a:*:*:*:*:*:* | 2.05 a | Vulnerable | GNU |
| cpe:2.3:a:gnu:bash:2.05:b:*:*:*:*:*:* | 2.05 b | Vulnerable | GNU |
| cpe:2.3:a:gnu:bash:3.0:*:*:*:*:*:*:* | 3.0 | Vulnerable | GNU |
| cpe:2.3:a:gnu:bash:3.0.16:*:*:*:*:*:*:* | 3.0.16 | Vulnerable | GNU |
| cpe:2.3:a:gnu:bash:3.1:*:*:*:*:*:*:* | 3.1 | Vulnerable | GNU |
| cpe:2.3:a:gnu:bash:3.2:*:*:*:*:*:*:* | 3.2 | Vulnerable | GNU |
| cpe:2.3:a:gnu:bash:3.2.48:*:*:*:*:*:*:* | 3.2.48 | Vulnerable | GNU |
| cpe:2.3:a:gnu:bash:4.0:*:*:*:*:*:*:* | 4.0 | Vulnerable | GNU |
| cpe:2.3:a:gnu:bash:4.0:rc1:*:*:*:*:*:* | 4.0 rc1 | Vulnerable | GNU |
| cpe:2.3:a:gnu:bash:4.1:*:*:*:*:*:*:* | 4.1 | Vulnerable | GNU |
| cpe:2.3:a:gnu:bash:4.2:*:*:*:*:*:*:* | 4.2 | Vulnerable | GNU |
| cpe:2.3:a:gnu:bash:4.3:*:*:*:*:*:*:* | 4.3 | Vulnerable | GNU |
- cpe:2.3:a:gnu:bash:2.01.1:*:*:*:*:*:*:* Versions 2.01.1 Vulnerable ·GNU
- cpe:2.3:a:gnu:bash:2.02:*:*:*:*:*:*:* Versions 2.02 Vulnerable ·GNU
- cpe:2.3:a:gnu:bash:2.02.1:*:*:*:*:*:*:* Versions 2.02.1 Vulnerable ·GNU
- cpe:2.3:a:gnu:bash:2.03:*:*:*:*:*:*:* Versions 2.03 Vulnerable ·GNU
- cpe:2.3:a:gnu:bash:2.04:*:*:*:*:*:*:* Versions 2.04 Vulnerable ·GNU
- cpe:2.3:a:gnu:bash:2.05:*:*:*:*:*:*:* Versions 2.05 Vulnerable ·GNU
- cpe:2.3:a:gnu:bash:2.05:a:*:*:*:*:*:* Versions 2.05 a Vulnerable ·GNU
- cpe:2.3:a:gnu:bash:2.05:b:*:*:*:*:*:* Versions 2.05 b Vulnerable ·GNU
- cpe:2.3:a:gnu:bash:3.0:*:*:*:*:*:*:* Versions 3.0 Vulnerable ·GNU
- cpe:2.3:a:gnu:bash:3.0.16:*:*:*:*:*:*:* Versions 3.0.16 Vulnerable ·GNU
- cpe:2.3:a:gnu:bash:3.1:*:*:*:*:*:*:* Versions 3.1 Vulnerable ·GNU
- cpe:2.3:a:gnu:bash:3.2:*:*:*:*:*:*:* Versions 3.2 Vulnerable ·GNU
- cpe:2.3:a:gnu:bash:3.2.48:*:*:*:*:*:*:* Versions 3.2.48 Vulnerable ·GNU
- cpe:2.3:a:gnu:bash:4.0:*:*:*:*:*:*:* Versions 4.0 Vulnerable ·GNU
- cpe:2.3:a:gnu:bash:4.0:rc1:*:*:*:*:*:* Versions 4.0 rc1 Vulnerable ·GNU
- cpe:2.3:a:gnu:bash:4.1:*:*:*:*:*:*:* Versions 4.1 Vulnerable ·GNU
- cpe:2.3:a:gnu:bash:4.2:*:*:*:*:*:*:* Versions 4.2 Vulnerable ·GNU
- cpe:2.3:a:gnu:bash:4.3:*:*:*:*:*:*:* Versions 4.3 Vulnerable ·GNU
Remediation
No fixed version listed by the sources yet.
Vendor assessments
Red Hat
Not affected: 5 products
- Red Hat Enterprise Linux 4
- Red Hat Enterprise Linux 5
- Red Hat Enterprise Linux 6
- Red Hat Enterprise Linux 7
- Red Hat Enterprise Virtualization 3
Timeline
- 2026-10-02 Threatist record created from CVE-2014-6277
- 2026-10-03 Alias added: GHSA-55cc-h8m2-x3mp
References
Advisory 30
- HPSBMU03165
- SSRT101819
- HPSBMU03245
- JVN#55667175
- HPSBMU03143
- HPSBMU03182
- HPSBST03155
- openSUSE-SU-2014:1310
- HPSBMU03246
- APPLE-SA-2015-09-30-3
- USN-2380-1
- HPSBMU03217
- SSRT101868
- HPSBST03129
- HPSBMU03144
- JVNDB-2014-000126
- SUSE-SU-2014:1287
- MDVSA-2015:164
- 20140926 GNU Bash Environment Variable Command Injection Vulnerability
- HPSBST03157
- SSRT101830
- HPSBST03154
- HPSBGN03142
- HPSBST03181
- HPSBHF03145
- HPSBGN03138
- HPSBHF03125
- HPSBHF03146
- APPLE-SA-2015-01-27-4
- HPSBGN03141
Other 40
- http://www-01.ibm.com/support/docview.wss?uid=ssg1S1004897
- http://www-01.ibm.com/support/docview.wss?uid=swg21685749
- https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk102673&src=securityAlerts
- http://linux.oracle.com/errata/ELSA-2014-3093
- http://www-01.ibm.com/support/docview.wss?uid=swg21686479
- http://www-01.ibm.com/support/docview.wss?uid=swg21685541
- http://www.oracle.com/technetwork/topics/security/bashcve-2014-7169-2317675.html
- https://kc.mcafee.com/corporate/index?page=content&id=SB10085
- http://www-947.ibm.com/support/entry/portal/docdisplay?lndocid=MIGR-5096315
- https://support.f5.com/kb/en-us/solutions/public/15000/600/sol15629.html
- http://www-01.ibm.com/support/docview.wss?uid=swg21685604
- http://www-01.ibm.com/support/docview.wss?uid=swg21686445
- http://www-01.ibm.com/support/docview.wss?uid=swg21686131
- https://kb.juniper.net/InfoCenter/index?page=content&id=JSA10648
- http://www-01.ibm.com/support/docview.wss?uid=ssg1S1004898
- http://www-01.ibm.com/support/docview.wss?uid=swg21685914
- https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-c04497075
- https://support.apple.com/HT205267
- http://packetstormsecurity.com/files/128567/CA-Technologies-GNU-Bash-Shellshock.html
- http://lcamtuf.blogspot.com/2014/10/bash-bug-how-we-finally-cracked.html
- https://www.suse.com/support/shellshock/
- http://support.apple.com/HT204244
- https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-c04518183
- http://www-01.ibm.com/support/docview.wss?uid=isg3T1021272
- http://linux.oracle.com/errata/ELSA-2014-3094
- http://www.vmware.com/security/advisories/VMSA-2014-0010.html
- http://www.novell.com/support/kb/doc.php?id=7015721
- http://www-01.ibm.com/support/docview.wss?uid=swg21687079
- http://www-01.ibm.com/support/docview.wss?uid=swg21686246
- http://www-01.ibm.com/support/docview.wss?uid=ssg1S1004915
- http://www.qnap.com/i/en/support/con_show.php?cid=61
- http://www-01.ibm.com/support/docview.wss?uid=isg3T1021279
- https://support.citrix.com/article/CTX200223
- http://www-01.ibm.com/support/docview.wss?uid=isg3T1021361
- https://support.citrix.com/article/CTX200217
- http://www-01.ibm.com/support/docview.wss?uid=swg21686494
- http://support.novell.com/security/cve/CVE-2014-6277.html
- https://kb.bluecoat.com/index?page=content&id=SA82
- http://www-01.ibm.com/support/docview.wss?uid=swg21685733
- http://www-01.ibm.com/support/docview.wss?uid=ssg1S1004879
More GNU Bash vulnerabilities
- TI-2014-05975 GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed… KEVCVSS 3.1CRITICAL 9.8
- TI-2014-05157 GNU Bash through 4.3 processes trailing strings after function definitions in the values… KEVCVSS 3.1CRITICAL 9.8
- TI-2014-05164 GNU Bash through 4.3 bash43-026 does not properly parse function definitions in the… KEVCVSS 3.1HIGH 8.8
- TI-2014-05988 The redirection implementation in parse.y in GNU Bash through 4.3 bash43-026 allows… CVSS 2.0HIGH 10.0
- TI-2014-05989 Off-by-one error in the read_token_word function in parse.y in GNU Bash through 4.3… CVSS 2.0HIGH 10.0
- TI-2022-03415 Memory corruption in bash CVSS 3.1HIGH 7.8
Sources
- CVE-2014-6277 · CVE Program
- CVE-2014-6277 · NVD
- FIRST EPSS
- GHSA-55cc-h8m2-x3mp · GitHub Advisory Database · CC BY 4.0
- CVE-2014-6277 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences