Szabolcs Nagy

Stories

musl libc discloses integer overflow in regex compiler affecting all versions

Authored the regex fix series and the overflow analysis

On October 21, musl maintainer Rich Felker disclosed CVE-2026-107891: integer overflows in regcomp, the regular expression compiler in the C library used by Alpine Linux and many container images. The flaw has been in every musl release since 0.5.0 and can produce undersized memory allocations followed by out-of-bounds writes. At minimum it crashes programs; code execution is possible depending on how the application uses the heap.

Updated Nov 2