GNU Bash through 4.3 bash43-026 does not properly parse function definitions in the…
Priority CRITICAL 97Exploited in the wildCWE-78Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-78.
Summary
GNU Bash through 4.3 bash43-026 does not properly parse function definitions in the values of environment variables, which allows remote attackers to execute arbitrary commands via a crafted environment, as demonstrated by vectors involving the ForceCommand feature in OpenSSH sshd, the mod_cgi and mod_cgid modules in the Apache HTTP Server, scripts executed by unspecified DHCP clients, and other situations in which setting the environment occurs across a privilege boundary from Bash execution. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-6271, CVE-2014-7169, and CVE-2014-6277.
Why it matters now
Exploitation Active In CISA KEV since 2025-10-02CISA due date 2025-10-23
EPSS 0.99669 99th percentileScored 2026-11-07
Public exploit Yes 2 exploit referencesTagged by the CNA
Fix No fix listed No fixed version in the sources yet
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Active
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
CPE configurations NVD · 28
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:gnu:bash:1.14.0:*:*:*:*:*:*:* | 1.14.0 | Vulnerable | GNU |
| cpe:2.3:a:gnu:bash:1.14.1:*:*:*:*:*:*:* | 1.14.1 | Vulnerable | GNU |
| cpe:2.3:a:gnu:bash:1.14.2:*:*:*:*:*:*:* | 1.14.2 | Vulnerable | GNU |
| cpe:2.3:a:gnu:bash:1.14.3:*:*:*:*:*:*:* | 1.14.3 | Vulnerable | GNU |
| cpe:2.3:a:gnu:bash:1.14.4:*:*:*:*:*:*:* | 1.14.4 | Vulnerable | GNU |
| cpe:2.3:a:gnu:bash:1.14.5:*:*:*:*:*:*:* | 1.14.5 | Vulnerable | GNU |
| cpe:2.3:a:gnu:bash:1.14.6:*:*:*:*:*:*:* | 1.14.6 | Vulnerable | GNU |
| cpe:2.3:a:gnu:bash:1.14.7:*:*:*:*:*:*:* | 1.14.7 | Vulnerable | GNU |
| cpe:2.3:a:gnu:bash:2.0:*:*:*:*:*:*:* | 2.0 | Vulnerable | GNU |
| cpe:2.3:a:gnu:bash:2.01:*:*:*:*:*:*:* | 2.01 | Vulnerable | GNU |
- cpe:2.3:a:gnu:bash:1.14.0:*:*:*:*:*:*:* Versions 1.14.0 Vulnerable ·GNU
- cpe:2.3:a:gnu:bash:1.14.1:*:*:*:*:*:*:* Versions 1.14.1 Vulnerable ·GNU
- cpe:2.3:a:gnu:bash:1.14.2:*:*:*:*:*:*:* Versions 1.14.2 Vulnerable ·GNU
- cpe:2.3:a:gnu:bash:1.14.3:*:*:*:*:*:*:* Versions 1.14.3 Vulnerable ·GNU
- cpe:2.3:a:gnu:bash:1.14.4:*:*:*:*:*:*:* Versions 1.14.4 Vulnerable ·GNU
- cpe:2.3:a:gnu:bash:1.14.5:*:*:*:*:*:*:* Versions 1.14.5 Vulnerable ·GNU
- cpe:2.3:a:gnu:bash:1.14.6:*:*:*:*:*:*:* Versions 1.14.6 Vulnerable ·GNU
- cpe:2.3:a:gnu:bash:1.14.7:*:*:*:*:*:*:* Versions 1.14.7 Vulnerable ·GNU
- cpe:2.3:a:gnu:bash:2.0:*:*:*:*:*:*:* Versions 2.0 Vulnerable ·GNU
- cpe:2.3:a:gnu:bash:2.01:*:*:*:*:*:*:* Versions 2.01 Vulnerable ·GNU
Show 18 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:gnu:bash:2.01.1:*:*:*:*:*:*:* | 2.01.1 | Vulnerable | GNU |
| cpe:2.3:a:gnu:bash:2.02:*:*:*:*:*:*:* | 2.02 | Vulnerable | GNU |
| cpe:2.3:a:gnu:bash:2.02.1:*:*:*:*:*:*:* | 2.02.1 | Vulnerable | GNU |
| cpe:2.3:a:gnu:bash:2.03:*:*:*:*:*:*:* | 2.03 | Vulnerable | GNU |
| cpe:2.3:a:gnu:bash:2.04:*:*:*:*:*:*:* | 2.04 | Vulnerable | GNU |
| cpe:2.3:a:gnu:bash:2.05:*:*:*:*:*:*:* | 2.05 | Vulnerable | GNU |
| cpe:2.3:a:gnu:bash:2.05:a:*:*:*:*:*:* | 2.05 a | Vulnerable | GNU |
| cpe:2.3:a:gnu:bash:2.05:b:*:*:*:*:*:* | 2.05 b | Vulnerable | GNU |
| cpe:2.3:a:gnu:bash:3.0:*:*:*:*:*:*:* | 3.0 | Vulnerable | GNU |
| cpe:2.3:a:gnu:bash:3.0.16:*:*:*:*:*:*:* | 3.0.16 | Vulnerable | GNU |
| cpe:2.3:a:gnu:bash:3.1:*:*:*:*:*:*:* | 3.1 | Vulnerable | GNU |
| cpe:2.3:a:gnu:bash:3.2:*:*:*:*:*:*:* | 3.2 | Vulnerable | GNU |
| cpe:2.3:a:gnu:bash:3.2.48:*:*:*:*:*:*:* | 3.2.48 | Vulnerable | GNU |
| cpe:2.3:a:gnu:bash:4.0:*:*:*:*:*:*:* | 4.0 | Vulnerable | GNU |
| cpe:2.3:a:gnu:bash:4.0:rc1:*:*:*:*:*:* | 4.0 rc1 | Vulnerable | GNU |
| cpe:2.3:a:gnu:bash:4.1:*:*:*:*:*:*:* | 4.1 | Vulnerable | GNU |
| cpe:2.3:a:gnu:bash:4.2:*:*:*:*:*:*:* | 4.2 | Vulnerable | GNU |
| cpe:2.3:a:gnu:bash:4.3:*:*:*:*:*:*:* | 4.3 | Vulnerable | GNU |
- cpe:2.3:a:gnu:bash:2.01.1:*:*:*:*:*:*:* Versions 2.01.1 Vulnerable ·GNU
- cpe:2.3:a:gnu:bash:2.02:*:*:*:*:*:*:* Versions 2.02 Vulnerable ·GNU
- cpe:2.3:a:gnu:bash:2.02.1:*:*:*:*:*:*:* Versions 2.02.1 Vulnerable ·GNU
- cpe:2.3:a:gnu:bash:2.03:*:*:*:*:*:*:* Versions 2.03 Vulnerable ·GNU
- cpe:2.3:a:gnu:bash:2.04:*:*:*:*:*:*:* Versions 2.04 Vulnerable ·GNU
- cpe:2.3:a:gnu:bash:2.05:*:*:*:*:*:*:* Versions 2.05 Vulnerable ·GNU
- cpe:2.3:a:gnu:bash:2.05:a:*:*:*:*:*:* Versions 2.05 a Vulnerable ·GNU
- cpe:2.3:a:gnu:bash:2.05:b:*:*:*:*:*:* Versions 2.05 b Vulnerable ·GNU
- cpe:2.3:a:gnu:bash:3.0:*:*:*:*:*:*:* Versions 3.0 Vulnerable ·GNU
- cpe:2.3:a:gnu:bash:3.0.16:*:*:*:*:*:*:* Versions 3.0.16 Vulnerable ·GNU
- cpe:2.3:a:gnu:bash:3.1:*:*:*:*:*:*:* Versions 3.1 Vulnerable ·GNU
- cpe:2.3:a:gnu:bash:3.2:*:*:*:*:*:*:* Versions 3.2 Vulnerable ·GNU
- cpe:2.3:a:gnu:bash:3.2.48:*:*:*:*:*:*:* Versions 3.2.48 Vulnerable ·GNU
- cpe:2.3:a:gnu:bash:4.0:*:*:*:*:*:*:* Versions 4.0 Vulnerable ·GNU
- cpe:2.3:a:gnu:bash:4.0:rc1:*:*:*:*:*:* Versions 4.0 rc1 Vulnerable ·GNU
- cpe:2.3:a:gnu:bash:4.1:*:*:*:*:*:*:* Versions 4.1 Vulnerable ·GNU
- cpe:2.3:a:gnu:bash:4.2:*:*:*:*:*:*:* Versions 4.2 Vulnerable ·GNU
- cpe:2.3:a:gnu:bash:4.3:*:*:*:*:*:*:* Versions 4.3 Vulnerable ·GNU
Remediation
No fixed version listed by the sources yet.
Vendor assessments
Red Hat
Not affected: 4 products
- Red Hat Enterprise Linux 4
- Red Hat Enterprise Linux 5
- Red Hat Enterprise Linux 6
- Red Hat Enterprise Linux 7
Timeline
- 2025-10-02 Added to CISA KEV
- 2026-10-02 Threatist record created from CVE-2014-6278
- 2026-10-03 Alias added: GHSA-6493-28fj-f93w
References
Advisory 69
- http://www-01.ibm.com/support/docview.wss?uid=ssg1S1004897
- http://www-01.ibm.com/support/docview.wss?uid=swg21685749
- HPSBMU03165
- https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk102673&src=securityAlerts
- http://linux.oracle.com/errata/ELSA-2014-3093
- SSRT101819
- HPSBMU03245
- http://www-01.ibm.com/support/docview.wss?uid=swg21686479
- JVN#55667175
- HPSBMU03143
- HPSBMU03182
- http://packetstormsecurity.com/files/137344/Sun-Secure-Global-Desktop-Oracle-Global-Desktop-Shellshock.html
- HPSBST03155
- http://www-01.ibm.com/support/docview.wss?uid=swg21685541
- http://www.oracle.com/technetwork/topics/security/bashcve-2014-7169-2317675.html
- openSUSE-SU-2014:1310
- HPSBMU03246
- https://kc.mcafee.com/corporate/index?page=content&id=SB10085
- USN-2380-1
- http://www-947.ibm.com/support/entry/portal/docdisplay?lndocid=MIGR-5096315
- https://support.f5.com/kb/en-us/solutions/public/15000/600/sol15629.html
- HPSBMU03217
- https://security-tracker.debian.org/tracker/CVE-2014-6278
- http://www-01.ibm.com/support/docview.wss?uid=swg21685604
- SSRT101868
- HPSBST03129
- HPSBMU03144
- http://www-01.ibm.com/support/docview.wss?uid=swg21686445
- http://www-01.ibm.com/support/docview.wss?uid=swg21686131
- JVNDB-2014-000126
- https://kb.juniper.net/InfoCenter/index?page=content&id=JSA10648
- SUSE-SU-2014:1287
- http://www-01.ibm.com/support/docview.wss?uid=ssg1S1004898
- http://www-01.ibm.com/support/docview.wss?uid=swg21685914
- MDVSA-2015:164
- https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-c04497075
- http://packetstormsecurity.com/files/128567/CA-Technologies-GNU-Bash-Shellshock.html
- http://lcamtuf.blogspot.com/2014/10/bash-bug-how-we-finally-cracked.html
- 20140926 GNU Bash Environment Variable Command Injection Vulnerability
- https://bugzilla.redhat.com/show_bug.cgi?id=1147414
- https://www.suse.com/support/shellshock/
- HPSBST03157
- https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-c04518183
- HPSBST03154
- http://www-01.ibm.com/support/docview.wss?uid=isg3T1021272
- HPSBGN03142
- http://linux.oracle.com/errata/ELSA-2014-3094
- http://www.vmware.com/security/advisories/VMSA-2014-0010.html
- HPSBST03181
- http://www.novell.com/support/kb/doc.php?id=7015721
- http://www-01.ibm.com/support/docview.wss?uid=swg21687079
- http://www-01.ibm.com/support/docview.wss?uid=swg21686246
- http://www-01.ibm.com/support/docview.wss?uid=ssg1S1004915
- http://support.novell.com/security/cve/CVE-2014-6278.html
- HPSBHF03145
- http://www.qnap.com/i/en/support/con_show.php?cid=61
- http://www-01.ibm.com/support/docview.wss?uid=isg3T1021279
- https://support.citrix.com/article/CTX200223
- HPSBGN03138
- HPSBHF03125
- HPSBHF03146
- http://www-01.ibm.com/support/docview.wss?uid=isg3T1021361
- HPSBGN03141
- https://support.citrix.com/article/CTX200217
- http://www-01.ibm.com/support/docview.wss?uid=swg21686494
- https://kb.bluecoat.com/index?page=content&id=SA82
- http://www-01.ibm.com/support/docview.wss?uid=swg21685733
- http://www-01.ibm.com/support/docview.wss?uid=ssg1S1004879
- https://www.arista.com/en/support/advisories-notices/security-advisories/1008-security-advisory-0006
More GNU Bash vulnerabilities
- TI-2014-05975 GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed… KEVCVSS 3.1CRITICAL 9.8
- TI-2014-05157 GNU Bash through 4.3 processes trailing strings after function definitions in the values… KEVCVSS 3.1CRITICAL 9.8
- TI-2014-05988 The redirection implementation in parse.y in GNU Bash through 4.3 bash43-026 allows… CVSS 2.0HIGH 10.0
- TI-2014-05163 GNU Bash through 4.3 bash43-026 does not properly parse function definitions in the… CVSS 2.0HIGH 10.0
- TI-2014-05989 Off-by-one error in the read_token_word function in parse.y in GNU Bash through 4.3… CVSS 2.0HIGH 10.0
- TI-2022-03415 Memory corruption in bash CVSS 3.1HIGH 7.8
Sources
- CVE-2014-6278 · CVE Program
- CVE-2014-6278 · NVD
- CISA Known Exploited Vulnerabilities
- FIRST EPSS
- GHSA-6493-28fj-f93w · GitHub Advisory Database · CC BY 4.0
- CVE-2014-6278 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences