{"id":"CVE-2026-107891","aliases":["ALPINE-CVE-2026-107891","BELL-CVE-2026-107891","DEBIAN-CVE-2026-107891","EUVD-2026-117543","GHSA-mr8f-pr8h-27pc","UBUNTU-CVE-2026-107891"],"status":"published","title":"musl libc before 1.2.7, when an untrusted regular expression is used with regcomp, has multiple...","description":"musl libc before 1.2.7, when an untrusted regular expression is used with regcomp, has multiple integer overflows, possibly leading to incorrect allocation sizes and out-of-bounds heap writes.","severity":{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00549,"percentile":0.46443,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-190"],"published":"2026-10-28T00:00:00Z","modified":"2026-11-06T09:30:02Z","fixes":[{"ecosystem":"Alpine:v3.20","package":"musl","fixed_in":["1.2.5-r4"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"musl","fixed_in":["1.2.5-r12"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"musl","fixed_in":["1.2.5-r13"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"musl","fixed_in":["1.2.5-r24"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"musl","fixed_in":["1.2.6-r3"],"sources":["osv"]},{"ecosystem":"Alpaquita:23","package":"musl-default","fixed_in":["1.2.4-r15"],"sources":["osv"]},{"ecosystem":"Alpaquita:23","package":"musl-perf","fixed_in":["1.2.4-r11"],"sources":["osv"]},{"ecosystem":"Alpaquita:25","package":"musl-default","fixed_in":["1.2.5-r17"],"sources":["osv"]},{"ecosystem":"Alpaquita:25","package":"musl-perf","fixed_in":["1.2.5-r19"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"musl-default","fixed_in":["1.2.6-r6"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"musl-perf","fixed_in":["1.2.6-r6"],"sources":["osv"]},{"ecosystem":"BellSoft Hardened Containers:23","package":"musl-default","fixed_in":["1.2.4-r15"],"sources":["osv"]},{"ecosystem":"BellSoft Hardened Containers:23","package":"musl-perf","fixed_in":["1.2.4-r11"],"sources":["osv"]},{"ecosystem":"BellSoft Hardened Containers:25","package":"musl-default","fixed_in":["1.2.5-r17"],"sources":["osv"]},{"ecosystem":"BellSoft Hardened Containers:25","package":"musl-perf","fixed_in":["1.2.5-r19"],"sources":["osv"]},{"ecosystem":"BellSoft Hardened Containers:stream","package":"musl-default","fixed_in":["1.2.6-r6"],"sources":["osv"]},{"ecosystem":"BellSoft Hardened Containers:stream","package":"musl-perf","fixed_in":["1.2.6-r6"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"musl","fixed_in":["1.2.6-2"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.20","package":"musl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.5-r4"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"musl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.5-r12"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"musl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.5-r13"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"musl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.5-r24"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"musl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.6-r3"}]}]},{"source":"osv","ecosystem":"Alpaquita:23","package":"musl-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.2.3-r11"},{"fixed":"1.2.4-r15"}]}]},{"source":"osv","ecosystem":"Alpaquita:23","package":"musl-perf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.2.3-r12"},{"fixed":"1.2.4-r11"}]}]},{"source":"osv","ecosystem":"Alpaquita:25","package":"musl-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.2.5-r12"},{"fixed":"1.2.5-r17"}]}]},{"source":"osv","ecosystem":"Alpaquita:25","package":"musl-perf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.2.5-r11"},{"fixed":"1.2.5-r19"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"musl-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.2.4-r0"},{"fixed":"1.2.6-r6"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"musl-perf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.2.4-r1"},{"fixed":"1.2.6-r6"}]}]},{"source":"osv","ecosystem":"BellSoft Hardened Containers:23","package":"musl-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.2.3-r11"},{"fixed":"1.2.4-r15"}]}]},{"source":"osv","ecosystem":"BellSoft Hardened Containers:23","package":"musl-perf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.2.3-r12"},{"fixed":"1.2.4-r11"}]}]},{"source":"osv","ecosystem":"BellSoft Hardened Containers:25","package":"musl-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.2.5-r12"},{"fixed":"1.2.5-r17"}]}]},{"source":"osv","ecosystem":"BellSoft Hardened Containers:25","package":"musl-perf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.2.5-r11"},{"fixed":"1.2.5-r19"}]}]},{"source":"osv","ecosystem":"BellSoft Hardened Containers:stream","package":"musl-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.2.4-r0"},{"fixed":"1.2.6-r6"}]}]},{"source":"osv","ecosystem":"BellSoft Hardened Containers:stream","package":"musl-perf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.2.4-r1"},{"fixed":"1.2.6-r6"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"musl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.2.3-1","1.2.4-1","1.2.4-2","1.2.5-1","1.2.5-1.1","1.2.5-2","1.2.5-3","1.2.5-3.1","1.2.5-3.1~deb13u1","1.2.6-1","1.2.6-2"]},{"source":"osv","ecosystem":"Debian:13","package":"musl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.2.5-3","1.2.5-3.1","1.2.5-3.1~deb13u1","1.2.6-1","1.2.6-2"]},{"source":"osv","ecosystem":"Debian:14","package":"musl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.6-2"}]}],"versions":["1.2.5-3","1.2.5-3.1","1.2.5-3.1~deb13u1","1.2.6-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"musl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.9.14-2","0.9.14-2ubuntu1","0.9.15-1","0.9.15-1ubuntu0.1~esm1","0.9.15-1ubuntu0.1~esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"musl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.1.9-1","1.1.9-1ubuntu0.1~esm2","1.1.9-1ubuntu0.1~esm3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"musl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.1.16-3","1.1.18-1","1.1.19-1","1.1.19-1ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"musl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.1.23-2build1","1.1.24-1","1.1.24-1ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"musl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.2.2-1","1.2.2-4"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"musl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.2.3-1","1.2.4-2"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"musl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.2.5-3build1","1.2.6-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"musl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.2.5-3","1.2.5-3build1"]}],"products":[{"vendor":"musl -libc","product":"musl"},{"vendor":"musl-libc","product":"musl"}],"references":[{"url":"https://musl.libc.org","tags":["web"]},{"url":"https://www.openwall.com/lists/musl/2026/10/21/1","tags":["web","report"]},{"url":"https://git.musl-libc.org/cgit/musl/commit/?id=7813e9119eb5fe681b6750b8a033a0490bca0941","tags":["web","report"]},{"url":"http://www.openwall.com/lists/oss-security/2026/10/21/18","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107891","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-mr8f-pr8h-27pc"},{"url":"https://security.alpinelinux.org/vuln/CVE-2026-107891","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2026-107891","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/107xxx/CVE-2026-107891.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-107891","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-107891","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-107891","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-107891","description":"musl libc before 1.2.7, when an untrusted regular expression is used with regcomp, has multiple integer overflows, possibly leading to incorrect allocation sizes and out-of-bounds heap writes.","status":"published","published":"2026-11-05T15:16:05.511Z","modified":"2026-11-09T22:09:56.385Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-190"],"updated_at":"2026-11-09T23:35:21.200784Z"}],"euvd":[{"id":"EUVD-2026-117543","description":"musl libc before 1.2.7, when an untrusted regular expression is used with regcomp, has multiple integer overflows, possibly leading to incorrect allocation sizes and out-of-bounds heap writes.","status":"published","published":"2026-11-05T15:16:05Z","modified":"2026-11-09T22:09:56Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-09T23:18:32.235826Z"}],"ghsa":[{"id":"GHSA-mr8f-pr8h-27pc","title":"musl libc before 1.2.7, when an untrusted regular expression is used with regcomp, has multiple...","description":"musl libc before 1.2.7, when an untrusted regular expression is used with regcomp, has multiple integer overflows, possibly leading to incorrect allocation sizes and out-of-bounds heap writes.","status":"published","published":"2026-11-05T18:33:12Z","modified":"2026-11-05T18:33:24Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-190"],"updated_at":"2026-11-05T18:55:26.763813Z"}],"nvd":[{"id":"CVE-2026-107891","description":"musl libc before 1.2.7, when an untrusted regular expression is used with regcomp, has multiple integer overflows, possibly leading to incorrect allocation sizes and out-of-bounds heap writes.","status":"published","published":"2026-11-05T16:17:32.15Z","modified":"2026-11-09T22:18:22.6Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-190"],"updated_at":"2026-11-09T23:16:05.167043Z"}],"osv":[{"id":"ALPINE-CVE-2026-107891","description":"musl libc before 1.2.7, when an untrusted regular expression is used with regcomp, has multiple integer overflows, possibly leading to incorrect allocation sizes and out-of-bounds heap writes.","status":"published","published":"2026-11-05T16:17:32.15Z","modified":"2026-11-06T09:30:02.945525194Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-06T09:36:49.371047Z"},{"id":"BELL-CVE-2026-107891","status":"published","published":"2026-10-28T19:38:54.639945Z","modified":"2026-11-07T07:15:03.381368388Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-07T07:40:27.39378Z"},{"id":"CVE-2026-107891","description":"musl libc before 1.2.7, when an untrusted regular expression is used with regcomp, has multiple integer overflows, possibly leading to incorrect allocation sizes and out-of-bounds heap writes.","status":"published","published":"2026-11-05T15:16:05.511Z","modified":"2026-11-11T07:19:02.844718134Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-190"],"updated_at":"2026-11-07T03:08:00.155606Z"},{"id":"DEBIAN-CVE-2026-107891","description":"musl libc before 1.2.7, when an untrusted regular expression is used with regcomp, has multiple integer overflows, possibly leading to incorrect allocation sizes and out-of-bounds heap writes.","status":"published","published":"2026-11-05T16:17:32.15Z","modified":"2026-11-10T09:47:44.766456145Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-10T10:26:30.347596Z"},{"id":"UBUNTU-CVE-2026-107891","description":"[Unknown description]","status":"published","published":"2026-10-28T00:00:00Z","modified":"2026-11-07T01:45:03.641640431Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-07T01:57:16.198641Z"}]}}