Read the docs
TI-2026-83331 Aliases CVE-2026-62303

Denial of service via stack exhaustion in Pistache router paths

Priority LOW 26CWE-400Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
High
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-400.

Summary

Pistache from 0.0.5 through 0.4.26 is a C++ REST toolkit whose router normalizes paths with a recursive regular expression. Paths containing tens of thousands of consecutive slashes can exhaust the stack and crash the process (CWE-674). An unauthenticated remote attacker can crash a server that accepts sufficiently long request paths, and direct router API use is affected when attacker-controlled route strings reach the normalizer.

Written with Claude Haiku 5.5 from the sources below · 2026-10-30

Description from the CNA

Pistache is a high-performance REST toolkit written in C++. From 0.0.5 through 0.4.26, `SegmentTreeNode::sanitizeResource()` in `src/server/router.cc` uses `std::regex_replace()` with the `//+` expression to collapse consecutive slashes. With libstdc++, a path containing tens of thousands of consecutive slash characters can recurse deeply enough to exhaust the stack and crash the process. `Router::route()`, `Router::addRoute()` and `Router::removeRoute()` reach this normalization. Unauthenticated remote exploitation is conditional on a deployment allowing sufficiently long request paths, such as by increasing `Endpoint::Options::maxRequestSize()` above the default 4096-byte limit or forwarding long paths through a front end. Direct router API use is also affected when attacker-controlled route or resource strings reach the normalizer. Native builds reproduced a crash around 24,000 consecutive slashes, although the exact threshold depends on the stack and standard library; the demonstrated failure is stack exhaustion rather than uninitialized-memory use. A source fix replaces recursive regular-expression normalization with an iterative pass, but no containing repository release was verified as of time of publication.

Why it matters now

EPSS 0.00308 23rd percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
pistacheiopistache0.0.5 – 0.4.26—No fix listedCNA
  • pistache Vendorpistacheio Affected 0.0.5 – 0.4.26 Fixed in — No fix listed CNA

Remediation

The sources list no fixed version for Pistache.

Written with Claude Haiku 5.5 from the sources below · 2026-10-30

Timeline

  1. 2026-10-30 Threatist record created from CVE-2026-62303
  2. 2026-11-01 Priority changed: MEDIUM → LOW

References

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences