musl libc

Stories

SSH password bypass exposes musl-based Linux systems

Plans a change to crypt() in an upcoming release

Any password longer than 256 characters will log an attacker into an account set up for SSH-key login only, on Alpine Linux and other systems that pair the musl C library with OpenSSH. The flaw, nicknamed *sshole, has worked that way since 2016.

Updated 5 days ago

musl libc discloses integer overflow in regex compiler affecting all versions

New Capabilities

Regcomp fix circulated for adoption; a separate regexec out-of-bounds read reported October 26 has no CVE or fix yet

On October 21, musl maintainer Rich Felker disclosed CVE-2026-107891: integer overflows in regcomp, the regular expression compiler in the C library used by Alpine Linux and many container images. The flaw has been in every musl release since 0.5.0 and can produce undersized memory allocations followed by out-of-bounds writes. At minimum it crashes programs; code execution is possible depending on how the application uses the heap.

Updated Nov 2