Alpine Linux

Stories

SSH password bypass exposes musl-based Linux systems

Shipped a patch on November 5, 2026

Any password longer than 256 characters will log an attacker into an account set up for SSH-key login only, on Alpine Linux and other systems that pair the musl C library with OpenSSH. The flaw, nicknamed *sshole, has worked that way since 2016.

Updated 5 days ago

musl libc discloses integer overflow in regex compiler affecting all versions

New Capabilities

Shipped fixed musl packages in four point releases

On October 21, musl maintainer Rich Felker disclosed CVE-2026-107891: integer overflows in regcomp, the regular expression compiler in the C library used by Alpine Linux and many container images. The flaw has been in every musl release since 0.5.0 and can produce undersized memory allocations followed by out-of-bounds writes. At minimum it crashes programs; code execution is possible depending on how the application uses the heap.

Updated Nov 2