CVE-2026-100290 · Infrastructure
NO FIX YET
When memory runs out during regex compilation or matching, the GNU C Library (glibc) can read freed memory and free the same heap block twice. The expected result for an attacker is a crash of the process that uses the regex, since control over which allocation fails is limited.
first public Nov 11, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Any Linux system or application linked against glibc versions 2.3 through 2.44 is potentially affected, since the flaw is in the core C library's regex functions. The issue only triggers when a memory allocation fails during regex compilation or matching, so it matters most on systems under memory pressure. Systems on glibc outside this range, or where no regex work runs, can skip it.
Not affected if glibc-outside-2.3-to-2.44, no-regex-processing
Who cares c-runtime, glibc, linux
ldd --version and compare it against the affected range 2.3 through 2.44.No fix yet, per the sources.
The regcomp and regexec functions in the GNU C Library version 2.3 to version 2.44 may read freed memory and free the same heap block twice when a memory allocation fails while a regular expression is compiled or matched. The re_dfa_add_node (the NFA node table) and build_range_exp (bracket ranges) grow several arrays with consecutive realloc calls and store the new pointers only after all of them succeed. When a later call fails, the pattern buffer keeps pointers to blocks that were already freed, and the error cleanup frees them again. In regexec, the back-reference cache (match_ctx_add_entry) frees its array when a realloc fails but keeps the pointer, which is freed again on the error path.
An attacker does not need to supply a crafted regular expression: patterns large enough to grow these arrays are common. The failure has to hit a specific allocation, though, so the issue can only be reached when the system is already under memory pressure. An attacker who supplies the pattern or the subject string has little control over which allocation fails, so the expected impact is a crash of the process. This issue affects all architectures and ABIs supported by the GNU C Library.
This page as .md · .json · CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.