musl libc discloses integer overflow in regex compiler affecting all versions

Overview

Updated 2 hours ago

On October 21, musl maintainer Rich Felker disclosed CVE-2026-107891: integer overflows in regcomp, the regular expression compiler in the compact C library that underpins Alpine Linux and most container images. The flaw has been present in every musl release since version 0.5.0 and can produce undersized heap allocations followed by out-of-bounds writes. At minimum it crashes programs; arbitrary code execution is possible depending on how the application uses the heap.

The trigger is the regex pattern itself, not the data being matched. Any service that compiles user-supplied expressions—filter rules, search syntax, access policy lists—is exposed until patched. The advisory includes a fix, Alpine and NixOS already carry patched packages, and a fixed 1.2.7 release is expected.

Why it matters

musl sits beneath Alpine Linux and most container workloads; an overflow triggered by untrusted regexes can crash services or enable code execution across millions of deployments.

Questions about this story

Free account needed to ask — your question is kept and asked for you right after sign-up. Answers are public.

No questions yet — be the first to ask.

Key Indicators

0.5.0–1.2.6

Affected version range

The vulnerable regcomp code has shipped in every musl release from 0.5.0 through 1.2.6.

Regex fix patches proposed

Szabolcs Nagy posted a 25-patch regex overhaul on October 15, holding back the overflow fix for private review.

1.2.6-r6

Alpine edge fixed build

Alpine's security tracker lists fixed musl builds for every maintained branch, from edge down to 3.21.

Voices

Curated perspectives — historical figures and your fellow readers.

Ever wondered what historical figures would say about today's headlines?

People Involved

Rich Felker

musl libc maintainer

Disclosed CVE-2026-107891 and circulated the fix

Szabolcs Nagy

musl contributor

Authored the regex fix series and the overflow analysis

Julien Voisin

Security researcher

Privately reported the first overflow

Natanael Copa

Alpine Linux musl maintainer

Shepherded fixed builds to all maintained Alpine branches

Organizations Involved

musl libc

Open-source C standard library

Vulnerable code disclosed; fix released for adoption

A lightweight C library implementing the POSIX standard for Linux, designed as a cleaner alternative to glibc.

Alpine Linux

Linux distribution

Fixed builds shipped to all maintained branches

A minimal, security-focused Linux distribution built on musl instead of glibc.

NixOS / nixpkgs

Linux distribution and package repository

Patch added via pull request

A declarative Linux distribution whose package repository packages musl for containers and custom systems.

Timeline

4 events Latest: Today

Tap a bar to jump to that date

October 2026
CVE-2026-107891 publicly disclosed
Today Security advisory

Rich Felker publishes the advisory on the musl and oss-security lists, describing integer overflows in regcomp affecting all versions since 0.5.0, and circulates a fix patch.
Today
NixOS opens patching pull request
Today Distribution patch

Maintainer jmbaur opens nixpkgs PR #576916, a one-file addition of the CVE-2026-107891 fix to the musl package.
Today
Alpine lists fixed builds for all branches
Today Distribution patch

Alpine's security tracker shows fixed musl packages for edge and every maintained release branch, from 3.21 through edge.
Today
Regex overhaul posted with overflow fix held back
Technical disclosure

Szabolcs Nagy posts a 25-patch regex fix series to the musl list; the integer overflow fix is marked '[1/25] int oflow, held back, being reviewed off-list.'
6 days ago

Scenarios

Working exploit for code execution is published

Unlikely Resolves by Q2 2027

Discussed by: Security researchers; the advisory states code execution is possible depending on application heap layout and concurrency

Researchers take the patch and work backward to construct a triggering regex, then tune heap layout in a target application such as a mail filter or log parser. LWN reports that remote code execution 'has not been demonstrated,' so this would be a novel development. A published proof of concept would push unpatched embedded-vendor products to act.

musl 1.2.7 ships and the ecosystem patches quietly

Likely Resolves by Feb 15, 2027

Discussed by: Felker's advisory, which directs users to the patch or 1.2.7; Alpine and NixOS have already moved

musl 1.2.7 releases with the regcomp fix. Mainstream distributions pick it up within weeks. Without a demonstrated exploit, the CVE is handled as a defensive fix effort, and the main residual risk lives in appliances and routers that vendor musl and rarely update.

Long tail of unpatched embedded musl remains vulnerable

Possible Resolves by End of 2027

Discussed by: Nagy's note that TRE has design and implementation issues; the advisory's warning about untrusted regex processing

Devices that embed musl—routers, IoT gateways, network appliances—do not publish regular security updates. Even after mainstream distributions patch, these products keep processing untrusted regexes in web interfaces and filter rules. Vulnerability scanners begin flagging the CVE in firmware audits through 2027.

Historical Context

3 moments from history that rhyme with this story — and how they unfolded.

2008–2016

glibc getaddrinfo overflow (CVE-2015-7547)

Google's security team found a stack buffer overflow in glibc's getaddrinfo, the function that resolves hostnames. The bug shipped in glibc since 2008 and could be triggered by a malicious DNS response, enabling remote code execution on virtually every Linux machine.

Then

Major distributions rushed patches within days; the flaw was widely exploited as 'Ghost' in combination with other bugs.

Now

It became a reference case for long-lived libc vulnerabilities and drove adoption of safer allocation patterns across the ecosystem.

Why this matters now

Like CVE-2026-107891, it is a multi-year-old bug in a ubiquitous C library function that processes untrusted input, with crash and code-execution potential that took years to surface.

2021–2023

glibc Looney Tunables (CVE-2023-4911)

Qualys disclosed a buffer overflow in glibc's dynamic loader, ld.so, triggered by a crafted GLIBC_TUNABLES environment variable. The affected code had shipped since glibc 2.34 in 2021 and allowed local privilege escalation to root.

Then

Updates shipped within days across enterprise and consumer distributions; Qualys published proof-of-concept code.

Now

The incident reinforced that core C library components are a high-value target because one bug reaches nearly every program on the system.

Why this matters now

Both flaws sit in the C library layer, where a single overflow in a parsing routine affects every application on the host.

2001–2012

TRE regex library abandonment

The TRE regex library, the base of musl's regex engine, went largely unmaintained after its author moved on. Known conformance and memory-safety issues accumulated without a dedicated fixer.

Then

Projects that incorporated TRE, including musl, inherited its bugs and maintained their own diverging fixes.

Now

Nagy's October 2026 series describes TRE as having design issues that make incremental fixes of limited value, with a rewrite suggested.

Why this matters now

CVE-2026-107891 is a direct consequence of musl inheriting TRE's implementation, and it explains why the regex engine remains a recurring source of memory-safety bugs.