musl libc fixes regcomp overflows that can corrupt the heap

musl libc fixes regcomp overflows that can corrupt the heap

21 October 2026: The maintainers of musl, the C standard library behind Alpine Linux and a large share of small container images, have disclosed CVE-2026-107891, a set of integer overflows in the regcomp function that can produce wrongly sized allocations and out-of-bounds heap writes. Every release from 0.5.0 through 1.2.6 is affected, and the project's own page tells all users to patch.

Not yet independently verified. This rests on the maintainer's own advisory and the musl project page; musl 1.2.7 had not been released when we read them, and we did not check which Linux distributions have shipped the patch. We will update this when it can be confirmed, and remove this note.

The overflows are triggered by the size and complexity of the regular expression being compiled, not by the text it is matched against. A program is exposed only if it passes regular expressions from an untrusted source to the libc regcomp function.

Impact and who is exposed

Rich Felker, musl's maintainer, says a predictable crash, and so a denial of service, is the least an attacker can achieve. Depending on how an application uses objects on the heap and whether it runs code concurrently, arbitrary code execution may be possible.

The usual exposure is a service that lets users supply a pattern: search or filter fields that accept regular expressions, log and alerting tools with user-defined rules, routing or rewrite configurations taken from tenants, and command-line tools fed patterns from files they do not control. Programs that use their own regex engine, as most language runtimes do, are not affected through that route, though a native extension that calls regcomp directly would be.

Patch first, upgrade later

There is no fixed release yet. The advisory asks users to apply the patch attached to the announcement, or to upgrade to musl 1.2.7 once it is published. Where patching is not possible, the advice is to stop processing regular expressions from untrusted sources.

For container fleets the practical route is the base image: once the distribution ships a patched musl package, rebuild every image that uses it rather than updating running containers, and check statically linked binaries separately, since they carry their own copy of the library and will not pick up a package update.

Credit and the other open musl advisories

Julien Voisin reported the first overflow privately, and further analysis by Szabolcs Nagy and Felker found a pattern of similar overflows. The project page lists it alongside two other current advisories, CVE-2026-40200 in qsort on 32-bit architectures and CVE-2026-6042 in iconv when exposed to untrusted data, both of which affected users should also patch. The next date to watch is the release of musl 1.2.7.

Related on TrustList:

• .NET out-of-band update fixes Brotli overflow and tarball flaw
• AWS CDK fixes a symlink flaw in Docker asset bundling in 2.267.0
• Docker Engine 29.8.2 fixes DNS trick that disables TLS checks

Sources

• oss-security: CVE-2026-107891, musl libc multiple integer overflow in regcomp (Rich Felker), 21 October 2026
• musl libc project page, security advisories (read 2026-10-26), 26 October 2026