Pull to refresh
Logo
What Changed
Following Why Sign Up
musl libc discloses integer overflow in regex compiler affecting all versions

musl libc discloses integer overflow in regex compiler affecting all versions

New Capabilities

Flaw in regcomp can crash programs or allow code execution; Alpine has shipped fixes and musl 1.2.7 is expected

October 28th, 2026: NotCVE records CVSS 9.8 and no known exploitation

Overview

Updated Nov 2

On October 21, musl maintainer Rich Felker disclosed CVE-2026-107891: integer overflows in regcomp, the regular expression compiler in the C library used by Alpine Linux and many container images. The flaw has been in every musl release since 0.5.0 and can produce undersized memory allocations followed by out-of-bounds writes. At minimum it crashes programs; code execution is possible depending on how the application uses the heap.

The trigger is the regex pattern itself, so a service that compiles user-supplied expressions stays exposed until patched. Alpine shipped fixed packages on October 22 for branches 3.21 through 3.24, and NixOS has an open patch pull request. On October 26, Calif.io, working with Anthropic, reported a separate out-of-bounds read in regexec that this CVE does not cover.

Why it matters

musl sits beneath Alpine Linux and most container workloads; an overflow triggered by untrusted regexes can crash services or enable code execution across millions of deployments.

Questions about this story

Free account needed to ask — your question is kept and asked for you right after sign-up. Answers are public.

No questions yet — be the first to ask.

Key Indicators

0.5.0–1.2.6
Affected version range
The vulnerable regcomp code has shipped in every musl release from 0.5.0 through 1.2.6.
9.8
CVSS severity score
NotCVE lists a CVSS v3.0 base score of 9.8 (Critical), using Tenable Nessus scoring. No known exploitation in the wild is recorded.
25
Regex fix patches proposed
Szabolcs Nagy posted a 25-patch regex overhaul on October 15, holding back the overflow fix for private review.
4
Alpine branches patched
Point releases 3.21.9, 3.22.7, 3.23.7 and 3.24.3 carry the musl fix.

Voices

Curated perspectives — historical figures and your fellow readers.

Sign up to generate historical perspectives on this story.

Log in Sign Up

People Involved

RF
Rich Felker
musl libc maintainer
Disclosed CVE-2026-107891 and circulated the fix
 Szabolcs Nagy
Szabolcs Nagy
musl contributor
Authored the regex fix series and the overflow analysis
JV
Julien Voisin
Security researcher
Privately reported the first overflow
NC
Natanael Copa
Alpine Linux musl maintainer
Shepherded fixed builds to all maintained Alpine branches

Organizations Involved

musl libc
musl libc
Open-source C standard library
Regcomp fix circulated for adoption; a separate regexec out-of-bounds read reported October 26 has no CVE or fix yet

A lightweight C library implementing the POSIX standard for Linux, designed as a cleaner alternative to glibc.
Alpine Linux
Alpine Linux
Linux distribution
Shipped fixed musl packages in four point releases

A minimal, security-focused Linux distribution built on musl instead of glibc.
NixOS / nixpkgs
NixOS / nixpkgs
Linux distribution and package repository
Patch added via pull request

A declarative Linux distribution whose package repository packages musl for containers and custom systems.

Timeline

9 events Latest: October 28th, 2026 · 2 weeks ago
Tap a bar to jump to that date

  1. NotCVE records CVSS 9.8 and no known exploitation

    Latest Vulnerability record

    The NotCVE database lists a CVSS v3.0 score of 9.8 (Critical) from Tenable Nessus and marks the CVE as not exploited in the wild. It also lists a Debian tracker entry dated 2026-10-26.

  2. Nagy asks reporters for source-level reproduction

    Technical disclosure

    Szabolcs Nagy replied to Thai Duong of Calif.io and asked where the source-level reproduction was. The report had pointed to a proof of concept at a Google Drive link.

  3. Calif.io reports separate regexec out-of-bounds read

    Security advisory

    Calif.io, working with Anthropic, reported an out-of-bounds read in musl's regexec backreference matcher to the musl list. The report says the bug affects 1.2.6 and master, and no CVE covers it.

  4. Alpine ships fixed musl in four point releases

    Distribution patch

    Alpine releases 3.21.9, 3.22.7, 3.23.7 and 3.24.3 with the CVE-2026-107891 fix for musl, alongside other security updates.

  5. Docker Scout flags patched Alpine 3.24 musl package

    Scanner dispute

    Docker Scout reported CVE-2026-107891 against Alpine 3.24's musl 1.2.6-r3 package, using an r6 fixed threshold. Alpine's tracker lists r3 as the fix for 3.24, so the scanner appears to have used edge's data.

  6. CVE-2026-107891 publicly disclosed

    Security advisory

    Rich Felker publishes the advisory on the musl and oss-security lists, describing integer overflows in regcomp affecting all versions since 0.5.0, and circulates a fix patch.

  7. NixOS opens patching pull request

    Distribution patch

    Maintainer jmbaur opens nixpkgs PR #576916, a one-file addition of the CVE-2026-107891 fix to the musl package.

  8. Alpine lists fixed builds for all branches

    Distribution patch

    Alpine's security tracker shows fixed musl packages for edge and every maintained release branch, from 3.21 through edge.

  9. Regex overhaul posted with overflow fix held back

    Technical disclosure

    Szabolcs Nagy posts a 25-patch regex fix series to the musl list; the integer overflow fix is marked '[1/25] int oflow, held back, being reviewed off-list.'

Scenarios

1

Working exploit for code execution is published

Unlikely Resolves by Q2 2027

Discussed by: Security researchers; the advisory states code execution is possible depending on application heap layout and concurrency

Researchers take the patch and work backward to construct a triggering regex, then tune heap layout in a target application such as a mail filter or log parser. LWN reports that remote code execution 'has not been demonstrated,' so this would be a novel development. A published proof of concept would push unpatched embedded-vendor products to act.

2

musl 1.2.7 ships and the ecosystem patches quietly

Likely Resolves by Feb 15, 2027

Discussed by: Felker's advisory, which directs users to the patch or 1.2.7; Alpine and NixOS have already moved

musl 1.2.7 releases with the regcomp fix. Mainstream distributions pick it up within weeks. Without a demonstrated exploit, the CVE is handled as a defensive fix effort, and the main residual risk lives in appliances and routers that vendor musl and rarely update.

3

Long tail of unpatched embedded musl remains vulnerable

Possible Resolves by End of 2027

Discussed by: Nagy's note that TRE has design and implementation issues; the advisory's warning about untrusted regex processing

Devices that embed musl—routers, IoT gateways, network appliances—do not publish regular security updates. Even after mainstream distributions patch, these products keep processing untrusted regexes in web interfaces and filter rules. Vulnerability scanners begin flagging the CVE in firmware audits through 2027.

4

Separate regexec bug gets its own CVE and patch

Uncertain Resolves by End of 2026

Discussed by: Calif.io and Anthropic, who filed the report; Szabolcs Nagy, who asked for a reproduction

The regexec backreference read is separate from CVE-2026-107891 and has no CVE. A fix would need the reproduction Nagy requested, and it could ship with or after musl 1.2.7.

Historical Context

3 moments from history that rhyme with this story — and how they unfolded.

2008–2016

glibc getaddrinfo overflow (CVE-2015-7547)

Google's security team found a stack buffer overflow in glibc's getaddrinfo, the function that resolves hostnames. The bug shipped in glibc since 2008 and could be triggered by a malicious DNS response, enabling remote code execution on virtually every Linux machine.

Then

Major distributions rushed patches within days; the flaw was widely exploited as 'Ghost' in combination with other bugs.

Now

It became a reference case for long-lived libc vulnerabilities and drove adoption of safer allocation patterns across the ecosystem.

Why this matters now

Like CVE-2026-107891, it is a multi-year-old bug in a ubiquitous C library function that processes untrusted input, with crash and code-execution potential that took years to surface.

2021–2023

glibc Looney Tunables (CVE-2023-4911)

Qualys disclosed a buffer overflow in glibc's dynamic loader, ld.so, triggered by a crafted GLIBC_TUNABLES environment variable. The affected code had shipped since glibc 2.34 in 2021 and allowed local privilege escalation to root.

Then

Updates shipped within days across enterprise and consumer distributions; Qualys published proof-of-concept code.

Now

The incident reinforced that core C library components are a high-value target because one bug reaches nearly every program on the system.

Why this matters now

Both flaws sit in the C library layer, where a single overflow in a parsing routine affects every application on the host.

2001–2012

TRE regex library abandonment

The TRE regex library, the base of musl's regex engine, went largely unmaintained after its author moved on. Known conformance and memory-safety issues accumulated without a dedicated fixer.

Then

Projects that incorporated TRE, including musl, inherited its bugs and maintained their own diverging fixes.

Now

Nagy's October 2026 series describes TRE as having design issues that make incremental fixes of limited value, with a rewrite suggested.

Why this matters now

CVE-2026-107891 is a direct consequence of musl inheriting TRE's implementation, and it explains why the regex engine remains a recurring source of memory-safety bugs.

Sources

(13)
+7
musl mailing list Alpine Linux GitHub (NixOS/nixpkgs) LWN.net musl git musl libc linuxcompatible.org NotCVE musl mailing list oss-security musl mailing list musl mailing list GitHub (docker/scout-cli)