musl libc

New Capabilities

Vulnerable code disclosed; fix released for adoption

On October 21, musl maintainer Rich Felker disclosed CVE-2026-107891: integer overflows in regcomp, the regular expression compiler in the compact C library that underpins Alpine Linux and most container images. The flaw has been present in every musl release since version 0.5.0 and can produce undersized heap allocations followed by out-of-bounds writes. At minimum it crashes programs; arbitrary code execution is possible depending on how the application uses the heap.

Updated Yesterday