Detections
Analytics
Alpine: multiple musl packages: security update to 1.2.5-r12
high Tenable Self-Hosted Container Security Plugin ID 476509
Description
There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:- An issue was discovered in musl libc 0.7.10 through 1.2.6. Stack-based memory corruption can occur during
qsort of very large arrays, due to incorrectly implemented double-word primitives. The number of elements
must exceed about seven million, i.e., the 32nd Leonardo number on 32-bit platforms (or the 64th Leonardo
number on 64-bit platforms, which is not practical). (CVE-2026-40200)
- musl libc before 1.2.7, when an untrusted regular expression is used with regcomp, has multiple integer
overflows, possibly leading to incorrect allocation sizes and out-of-bounds heap writes. (CVE-2026-107891)
Solution
Update the musl library and its related packages to version 1.2.5-r12 or later.See Also
Plugin Details
Severity: High
ID: 476509
Version: Revision 1.2
Type: Local
Published: 10/21/2026
Updated: 11/6/2026
Supported Sensors: Agentless Assessment, Tenable Cloud Security, Tenable Self-Hosted Container Security
Risk Information
VPR
Risk Factor: High
Score: 7.6
Percentile: 98.11
CVSS v2
Risk Factor: High
Base Score: 7.6
Temporal Score: 5.6
Vector: CVSS2#AV:N/AC:H/Au:N/C:C/I:C/A:C
CVSS Score Source: CVE-2026-107891
CVSS v3
Risk Factor: High
Base Score: 8.1
Temporal Score: 7.1
Vector: CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C
CVSS Score Source: CVE-2026-40200
Vulnerability Information
Exploit Ease: No known exploits are available
Vulnerability Publication Date: 4/10/2026