musl's regcomp Has Integer Overflows in Every Release Since 0.5.0, and the Fix Is 1.2.7, Not Yet Out

An application that passes regular expressions from an untrusted source to musl's regcomp can be made to allocate too little memory and write past it, which is at minimum a predictable crash and possibly code execution. Rich Felker disclosed the flaw as CVE-2026-107891 on the oss-security list on Wednesday 21 October 2026 at 11:43 -0400, and every musl release through 1.2.6 is affected.

The fixed release, 1.2.7, was described as not yet available when he posted. The advisory gives no CVSS score, no fix commit hash and no release date for 1.2.7. The latest release listed on musl's own releases page is 1.2.6, dated 20 March 2026.

What an attacker needs

The overflows depend on "the size and complexity of the regular expression passed to regcomp," not on the text being matched. The attacker therefore has to control the pattern. A service that lets users supply search patterns, filter rules or validation expressions and compiles them with musl qualifies. A service that compiles only fixed patterns does not.

The advisory credits the first report, made privately, to Julien Voisin. Szabolcs Nagy and Rich Felker then found what the post calls a pattern of similar overflows in the same function, which is why it is filed as one CVE covering multiple overflows. The vulnerable code has been present since musl 0.5.0.

Mitigation before the release

There are three options in the advisory, in order of preference:

• Apply the attached patch, 0001-regex-avoid-int-overflow-in-regcomp.patch (5,943 bytes).
• Upgrade to musl 1.2.7 when it ships.
• Where neither is possible, stop compiling regular expressions from untrusted sources.

Alpine moved first

The Alpine Linux security tracker already marks every listed branch fixed for the musl source package. The tracker's description field is empty and its severity reads unknown, so its entry carries versions only.

Alpine branch	Fixed musl package
edge-main	1.2.6-r6
3.24-main	1.2.6-r3
3.23-main	1.2.5-r24
3.22-main	1.2.5-r13
3.21-main	1.2.5-r12

Those revision numbers show distribution patches on top of 1.2.5 and 1.2.6, not a 1.2.7 upgrade. Anyone running another musl-based distribution should check for the same backport rather than wait for the upstream tag.

Where this sits among musl's advisories

The score cannot be judged yet because there is none, and the preconditions are narrow. The musl releases page lists recent advisories that also affect all versions through 1.2.6, including CVE-2026-40200, a stack-based overflow in qsort with large arrays on 32-bit architectures, and CVE-2026-6042, a denial of service in the iconv GB18030 decoder. The page does not list CVE-2026-107891 yet.

Regex compilers have been a busy surface this week. GitLab patched a CVSS 10.0 overflow in its own regex compiler on 21 October, and the PHP release the same day fixed two memory-corruption bugs. Those are separate flaws in separate code, and nothing in the musl advisory links them.

The next milestone is the 1.2.7 tag. Until then, the patch file and the distribution backports are the only fixes.