musl libc@musl@social.treehouse.systems: SECURITY ADVISORY: musl libc up through 1.2.6 (pre…

Home | Notifications | New Note | Local | Federated | Search | Logout

Note Detail

musl libc@musl@social.treehouse.systems (2026-10-22 00:48:09)
SECURITY ADVISORY: musl libc up through 1.2.6 (present version) is affected by integer overflows in regcomp (regular expression handling) leading to insufficient allocation of heap-based buffers for the compiled regex data structures.

CVE-2026-107891 has been assigned for this issue.

https://www.openwall.com/lists/musl/2026/10/21/1


---Replies---

musl libc@musl@social.treehouse.systems (2026-10-22 00:49:51)
The patch in the advisory email adds checking for the overflows and also establishes improved early bounds intended to prevent the overflow conditions from being reachable in the first place.