GNU Bash through 4.3 bash43-026 does not properly parse function definitions in the values of environment variables, which allows remote…

Description

GNU Bash through 4.3 bash43-026 does not properly parse function definitions in the values of environment variables, which allows remote attackers to execute arbitrary commands via a crafted environment, as demonstrated by vectors involving the ForceCommand feature in OpenSSH sshd, the mod_cgi and mod_cgid modules in the Apache HTTP Server, scripts executed by unspecified DHCP clients, and other situations in which setting the environment occurs across a privilege boundary from Bash execution. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-6271, CVE-2014-7169, and CVE-2014-6277.

Scores

EPSS (exploitation in 30 days)

99.7% · top 0.1% of all CVEs (6 Nov 2026)

CISA SSVC

Exploitation: active · Automatable: no · Technical impact: total

The list uses the assigner's score when there is one, then CISA's, then NVD's: High 8.8.

Weakness

• n/a
• CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (opens in a new tab)All about CWE-78 and its CVEs

Affected products

• n/a

  • affected n/a

References (111)

• http://www-01.ibm.com/support/docview.wss?uid=ssg1S1004897 (opens in a new tab)x_refsource_CONFIRMx_transferred
• http://www-01.ibm.com/support/docview.wss?uid=swg21685749 (opens in a new tab)x_refsource_CONFIRMx_transferred
• HPSBMU03165 (opens in a new tab)vendor-advisoryx_refsource_HPx_transferred
• https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk102673&src=securityAlerts (opens in a new tab)x_refsource_CONFIRMx_transferred
• http://linux.oracle.com/errata/ELSA-2014-3093 (opens in a new tab)x_refsource_CONFIRMx_transferred
• SSRT101819 (opens in a new tab)vendor-advisoryx_refsource_HPx_transferred
• HPSBMU03245 (opens in a new tab)vendor-advisoryx_refsource_HPx_transferred
• http://www-01.ibm.com/support/docview.wss?uid=swg21686479 (opens in a new tab)x_refsource_CONFIRMx_transferred
• JVN#55667175 (opens in a new tab)third-party-advisoryx_refsource_JVNx_transferred
• 60433 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
• HPSBMU03143 (opens in a new tab)vendor-advisoryx_refsource_HPx_transferred
• HPSBMU03182 (opens in a new tab)vendor-advisoryx_refsource_HPx_transferred
• http://packetstormsecurity.com/files/137344/Sun-Secure-Global-Desktop-Oracle-Global-Desktop-Shellshock.html (opens in a new tab)x_refsource_MISCx_transferred
• HPSBST03155 (opens in a new tab)vendor-advisoryx_refsource_HPx_transferred
• http://www-01.ibm.com/support/docview.wss?uid=swg21685541 (opens in a new tab)x_refsource_CONFIRMx_transferred
• http://www.oracle.com/technetwork/topics/security/bashcve-2014-7169-2317675.html (opens in a new tab)x_refsource_CONFIRMx_transferred
• 61816 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
• openSUSE-SU-2014:1310 (opens in a new tab)vendor-advisoryx_refsource_SUSEx_transferred
• 61442 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
• HPSBMU03246 (opens in a new tab)vendor-advisoryx_refsource_HPx_transferred
• 61283 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
• https://kc.mcafee.com/corporate/index?page=content&id=SB10085 (opens in a new tab)x_refsource_CONFIRMx_transferred
• 61654 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
• USN-2380-1 (opens in a new tab)vendor-advisoryx_refsource_UBUNTUx_transferred
• http://www-947.ibm.com/support/entry/portal/docdisplay?lndocid=MIGR-5096315 (opens in a new tab)x_refsource_CONFIRMx_transferred
• 62312 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
• https://support.f5.com/kb/en-us/solutions/public/15000/600/sol15629.html (opens in a new tab)x_refsource_CONFIRMx_transferred
• HPSBMU03217 (opens in a new tab)vendor-advisoryx_refsource_HPx_transferred
• https://security-tracker.debian.org/tracker/CVE-2014-6278 (opens in a new tab)x_refsource_CONFIRMx_transferred
• http://www-01.ibm.com/support/docview.wss?uid=swg21685604 (opens in a new tab)x_refsource_CONFIRMx_transferred
• SSRT101868 (opens in a new tab)vendor-advisoryx_refsource_HPx_transferred
• 61703 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
• 61065 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
• HPSBST03129 (opens in a new tab)vendor-advisoryx_refsource_HPx_transferred
• HPSBMU03144 (opens in a new tab)vendor-advisoryx_refsource_HPx_transferred
• http://www-01.ibm.com/support/docview.wss?uid=swg21686445 (opens in a new tab)x_refsource_CONFIRMx_transferred
• http://www-01.ibm.com/support/docview.wss?uid=swg21686131 (opens in a new tab)x_refsource_CONFIRMx_transferred
• JVNDB-2014-000126 (opens in a new tab)third-party-advisoryx_refsource_JVNDBx_transferred
• 61641 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
• 39887 (opens in a new tab)exploitx_refsource_EXPLOIT-DBx_transferred
• https://kb.juniper.net/InfoCenter/index?page=content&id=JSA10648 (opens in a new tab)x_refsource_CONFIRMx_transferred
• SUSE-SU-2014:1287 (opens in a new tab)vendor-advisoryx_refsource_SUSEx_transferred
• http://www-01.ibm.com/support/docview.wss?uid=ssg1S1004898 (opens in a new tab)x_refsource_CONFIRMx_transferred
• http://www-01.ibm.com/support/docview.wss?uid=swg21685914 (opens in a new tab)x_refsource_CONFIRMx_transferred
• MDVSA-2015:164 (opens in a new tab)vendor-advisoryx_refsource_MANDRIVAx_transferred
• https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-c04497075 (opens in a new tab)x_refsource_CONFIRMx_transferred
• 60325 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
• 60024 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
• http://packetstormsecurity.com/files/128567/CA-Technologies-GNU-Bash-Shellshock.html (opens in a new tab)x_refsource_MISCx_transferred
• http://lcamtuf.blogspot.com/2014/10/bash-bug-how-we-finally-cracked.html (opens in a new tab)x_refsource_MISCx_transferred
• 20140926 GNU Bash Environment Variable Command Injection Vulnerability (opens in a new tab)vendor-advisoryx_refsource_CISCOx_transferred
• https://bugzilla.redhat.com/show_bug.cgi?id=1147414 (opens in a new tab)x_refsource_CONFIRMx_transferred
• 62343 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
• 61565 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
• https://www.suse.com/support/shellshock/ (opens in a new tab)x_refsource_CONFIRMx_transferred
• HPSBST03157 (opens in a new tab)vendor-advisoryx_refsource_HPx_transferred
• 61313 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
• 61485 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
• https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-c04518183 (opens in a new tab)x_refsource_CONFIRMx_transferred
• HPSBST03154 (opens in a new tab)vendor-advisoryx_refsource_HPx_transferred
• http://www-01.ibm.com/support/docview.wss?uid=isg3T1021272 (opens in a new tab)x_refsource_CONFIRMx_transferred
• HPSBGN03142 (opens in a new tab)vendor-advisoryx_refsource_HPx_transferred
• 61312 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
• http://linux.oracle.com/errata/ELSA-2014-3094 (opens in a new tab)x_refsource_CONFIRMx_transferred
• 60193 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
• http://www.vmware.com/security/advisories/VMSA-2014-0010.html (opens in a new tab)x_refsource_CONFIRMx_transferred
• 60063 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
• 60034 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
• 59907 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
• 58200 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
• HPSBST03181 (opens in a new tab)vendor-advisoryx_refsource_HPx_transferred
• 61643 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
• http://www.novell.com/support/kb/doc.php?id=7015721 (opens in a new tab)x_refsource_CONFIRMx_transferred
• http://www-01.ibm.com/support/docview.wss?uid=swg21687079 (opens in a new tab)x_refsource_CONFIRMx_transferred
• 61503 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
• http://www-01.ibm.com/support/docview.wss?uid=swg21686246 (opens in a new tab)x_refsource_CONFIRMx_transferred
• http://www-01.ibm.com/support/docview.wss?uid=ssg1S1004915 (opens in a new tab)x_refsource_CONFIRMx_transferred
• http://support.novell.com/security/cve/CVE-2014-6278.html (opens in a new tab)x_refsource_CONFIRMx_transferred
• HPSBHF03145 (opens in a new tab)vendor-advisoryx_refsource_HPx_transferred
• http://www.qnap.com/i/en/support/con_show.php?cid=61 (opens in a new tab)x_refsource_CONFIRMx_transferred
• 61552 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
• 61780 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
• http://www-01.ibm.com/support/docview.wss?uid=isg3T1021279 (opens in a new tab)x_refsource_CONFIRMx_transferred
• https://support.citrix.com/article/CTX200223 (opens in a new tab)x_refsource_CONFIRMx_transferred
• 39568 (opens in a new tab)exploitx_refsource_EXPLOIT-DBx_transferred
• HPSBGN03138 (opens in a new tab)vendor-advisoryx_refsource_HPx_transferred
• 60044 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
• 61291 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
• HPSBHF03125 (opens in a new tab)vendor-advisoryx_refsource_HPx_transferred
• 61287 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
• HPSBHF03146 (opens in a new tab)vendor-advisoryx_refsource_HPx_transferred
• http://www-01.ibm.com/support/docview.wss?uid=isg3T1021361 (opens in a new tab)x_refsource_CONFIRMx_transferred
• HPSBGN03141 (opens in a new tab)vendor-advisoryx_refsource_HPx_transferred
• 61128 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
• https://support.citrix.com/article/CTX200217 (opens in a new tab)x_refsource_CONFIRMx_transferred
• 61471 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
• 60055 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
• 59961 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
• 61550 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
• 61633 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
• http://lcamtuf.blogspot.com/2014/09/bash-bug-apply-unofficial-patch-now.html (opens in a new tab)x_refsource_MISCx_transferred
• http://www-01.ibm.com/support/docview.wss?uid=swg21686494 (opens in a new tab)x_refsource_CONFIRMx_transferred
• https://kb.bluecoat.com/index?page=content&id=SA82 (opens in a new tab)x_refsource_CONFIRMx_transferred
• 61328 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
• http://www-01.ibm.com/support/docview.wss?uid=swg21685733 (opens in a new tab)x_refsource_CONFIRMx_transferred
• 61129 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
• 61603 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
• 61857 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
• http://www-01.ibm.com/support/docview.wss?uid=ssg1S1004879 (opens in a new tab)x_refsource_CONFIRMx_transferred
• https://www.arista.com/en/support/advisories-notices/security-advisories/1008-security-advisory-0006 (opens in a new tab)x_refsource_MISCx_transferred
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2014-6278 (opens in a new tab)government-resource

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• CISA KEV catalog (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisories (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Badge for a README or a ticket

[![CVE-2014-6278](https://trackcve.app/badge/CVE-2014-6278.svg)](https://trackcve.app/cve/CVE-2014-6278)

Record last updated 30 Dec 2025, 20:24 UTC.