---
id: CVE-2026-62303
title: >-
  Pistache: DoS via stack exhaustion in REST router path normalization
  (regex_replace on long slash runs)
summary: >-
  Pistache is a high-performance REST toolkit written in C++. From 0.0.5 through
  0.4.26, `SegmentTreeNode::sanitizeResource()` in `src/server/router.cc` uses
  `std::regex_replace()` with the `//+` expression to collapse consecutive
  slashes.…
severity: medium
cvss: 5.9
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H'
cvssSource: cna
cwe:
  - CWE-400
  - CWE-674
vendor: pistacheio
product: pistache
affected:
  - 'pistache >= 0.0.5, <= 0.4.26'
published: '2026-10-30'
updated: '2026-10-30'
sourceUpdated: '2026-10-30T18:58:10.308Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-62303'
references:
  - url: >-
      https://github.com/pistacheio/pistache/security/advisories/GHSA-q474-pqcp-gqm5
    label: >-
      https://github.com/pistacheio/pistache/security/advisories/GHSA-q474-pqcp-gqm5
  - url: >-
      https://github.com/pistacheio/pistache/commit/935461352403696f3ca0dbb9a7de7d2609e7ce91
    label: >-
      https://github.com/pistacheio/pistache/commit/935461352403696f3ca0dbb9a7de7d2609e7ce91
tags:
  - cve.org
epss: 0.00308
epssPercentile: 0.23821
ingestedAt: '2026-11-05T16:24:31.396Z'
---

## Overview

Pistache is a high-performance REST toolkit written in C++. From 0.0.5 through 0.4.26, `SegmentTreeNode::sanitizeResource()` in `src/server/router.cc` uses `std::regex_replace()` with the `//+` expression to collapse consecutive slashes. With libstdc++, a path containing tens of thousands of consecutive slash characters can recurse deeply enough to exhaust the stack and crash the process. `Router::route()`, `Router::addRoute()` and `Router::removeRoute()` reach this normalization. Unauthenticated remote exploitation is conditional on a deployment allowing sufficiently long request paths, such as by increasing `Endpoint::Options::maxRequestSize()` above the default 4096-byte limit or forwarding long paths through a front end. Direct router API use is also affected when attacker-controlled route or resource strings reach the normalizer. Native builds reproduced a crash around 24,000 consecutive slashes, although the exact threshold depends on the stack and standard library; the demonstrated failure is stack exhaustion rather than uninitialized-memory use. A source fix replaces recursive regular-expression normalization with an iterative pass, but no containing repository release was verified as of time of publication.

## Affected

- `pistache >= 0.0.5, <= 0.4.26`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.