NixOS / nixpkgs

Stories

musl libc discloses integer overflow in regex compiler affecting all versions

Patch added via pull request

On October 21, musl maintainer Rich Felker disclosed CVE-2026-107891: integer overflows in regcomp, the regular expression compiler in the C library used by Alpine Linux and many container images. The flaw has been in every musl release since 0.5.0 and can produce undersized memory allocations followed by out-of-bounds writes. At minimum it crashes programs; code execution is possible depending on how the application uses the heap.

Updated Nov 2