Shellshock: Bash function injection

Summary

Crafted environment variables can cause Bash to execute trailing commands, affecting CGI, SSH ForceCommand and other paths where an attacker controls the environment.

Component: GNU Bash. Disclosed: 24 September 2014. Last verified: 22 October 2026, 16:45 UTC.

Affected versions

Version ranges preserve the source wording. A distribution package may contain a backport without changing this string. NIST NVD

Fixed versions

Fixed through distribution packages. The original fix was incomplete; vendors issued follow-up updates. Apply the current vendor patch level, not just the first one. NIST NVD Red Hat

Conditions and scope

These are the conditions named by the sources. They are not a score and not a prediction.

• A service passes attacker-controlled environment variables across a privilege boundary into Bash.
• Examples in NVD include CGI, OpenSSH ForceCommand and some DHCP clients.
• A Bash version before the vendor's fully patched level.

Exploitation status

CISA added CVE-2014-6271 to KEV on 28 January 2022. Exploitation was widely reported in 2014; KEV does not quantify incidents.

Severity and scoring

Scores are listed with their version and assessor. Different CVSS versions, and different assessors, are not averaged. The presence of a high score does not establish exploitation, and a lower score does not make a memory-safety defect harmless.

Mechanism and trust boundary

Bash allows environment variables to carry function definitions. The affected versions processed trailing content after the function definition, so an attacker-controlled environment value could run commands when Bash started.

The flaw is not 'Bash is always remotely exploitable'. The condition is a path where an attacker can influence the environment of a Bash process, such as a CGI request or a forced SSH command. That is a trust-boundary problem as much as a parser problem.

Lessons

The first patch was incomplete. CVE-2014-7169 was assigned to the remaining issue, and vendors shipped follow-up packages. A single 'patched' label would have been misleading.

This site separates patch status from exploitation status for that reason. 'A fix exists' and 'this host has the complete fix' are different claims.

What to do

• Verify the serving runtime and the installed fix — useful for any runtime update, not only PHP.
• Interim controls and their limits — how to buy time without claiming a fix.
• Read the advisory labels correctly — CVSS versions, KEV, PoC and exploitation.

Sources

Last verified 22 October 2026, 16:45 UTC. A statement that no evidence was found in checked sources is not a statement that an event never occurred.