Denial of service via stack exhaustion in Pistache router paths
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- High
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-400.
Summary
Pistache from 0.0.5 through 0.4.26 is a C++ REST toolkit whose router normalizes paths with a recursive regular expression. Paths containing tens of thousands of consecutive slashes can exhaust the stack and crash the process (CWE-674). An unauthenticated remote attacker can crash a server that accepts sufficiently long request paths, and direct router API use is affected when attacker-controlled route strings reach the normalizer.
Written with Claude Haiku 5.5 from the sources below · 2026-10-30
Description from the CNA
Pistache is a high-performance REST toolkit written in C++. From 0.0.5 through 0.4.26, `SegmentTreeNode::sanitizeResource()` in `src/server/router.cc` uses `std::regex_replace()` with the `//+` expression to collapse consecutive slashes. With libstdc++, a path containing tens of thousands of consecutive slash characters can recurse deeply enough to exhaust the stack and crash the process. `Router::route()`, `Router::addRoute()` and `Router::removeRoute()` reach this normalization. Unauthenticated remote exploitation is conditional on a deployment allowing sufficiently long request paths, such as by increasing `Endpoint::Options::maxRequestSize()` above the default 4096-byte limit or forwarding long paths through a front end. Direct router API use is also affected when attacker-controlled route or resource strings reach the normalizer. Native builds reproduced a crash around 24,000 consecutive slashes, although the exact threshold depends on the stack and standard library; the demonstrated failure is stack exhaustion rather than uninitialized-memory use. A source fix replaces recursive regular-expression normalization with an iterative pass, but no containing repository release was verified as of time of publication.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| pistacheio | pistache | 0.0.5 – 0.4.26 | — | No fix listed | CNA |
- pistache Vendorpistacheio Affected 0.0.5 – 0.4.26 Fixed in — No fix listed CNA
Remediation
The sources list no fixed version for Pistache.
Written with Claude Haiku 5.5 from the sources below · 2026-10-30
Timeline
- 2026-10-30 Threatist record created from CVE-2026-62303
- 2026-11-01 Priority changed: MEDIUM → LOW
References
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences