CVE-2026-62303: Pistache: DoS via stack exhaustion in REST router path normalization (regex_replace on long slash runs)
Pistache is a high-performance REST toolkit written in C++. From 0.0.5 through 0.4.26, SegmentTreeNode::sanitizeResource() in src/server/router.cc uses std::regexreplace() with the //+ expression to collapse consecutive slashes. With libstdc++, a path containing tens of thousands of consecutive slash characters can recurse deeply enough to exhaust the stack and crash the process. Router::route(), Router::addRoute() and Router::removeRoute() reach this normalization. Unauthenticated remote exploitation is conditional on a deployment allowing sufficiently long request paths, such as by increasing Endpoint::Options::maxRequestSize() above the default 4096-byte limit or forwarding long paths through a front end. Direct router API use is also affected when attacker-controlled route or resource strings reach the normalizer. Native builds reproduced a crash around 24,000 consecutive slashes, although the exact threshold depends on the stack and standard library; the demonstrated failure is stack exhaustion rather than uninitialized-memory use. A source fix replaces recursive regular-expression normalization with an iterative pass, but no containing repository release was verified as of time of publication.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Keep the request-size limit at the default 4096-byte value; do not increase it to permit sufficiently long request paths.
Pistache Endpoint Endpoint::Options::maxRequestSize() = 4096 bytes
Event History
Frequently Asked Questions
Are deployments using the default request-size limit exposed to remote exploitation?
Remote exploitation is conditional on accepting a sufficiently long request path. The default Endpoint::Options::maxRequestSize() limit is 4096 bytes, while a native crash was reproduced at roughly 24,000 consecutive slashes; deployments that retain the default limit may not accept a path large enough for the demonstrated crash.
What conditions must an attacker meet to trigger the denial of service?
An unauthenticated attacker must be able to supply a request path containing tens of thousands of consecutive slash characters and have that path reach Pistache router normalization. This can occur when the request-size limit has been raised or when a front end forwards long paths.
Is the issue limited to HTTP requests?
No. Direct use of Router::route(), Router::addRoute(), or Router::removeRoute() is also affected if attacker-controlled route or resource strings reach the path normalizer.
What mitigation is available if a source fix cannot be applied immediately?
Keep the request-path size constrained, including retaining the default 4096-byte Endpoint::Options::maxRequestSize() limit, and ensure front ends do not forward unusually long paths. These measures reduce the ability to deliver the long slash runs needed for the demonstrated stack-exhaustion crash.
How can I assess whether my environment is vulnerable to the demonstrated failure?
Check whether Pistache versions from 0.0.5 through 0.4.26 are in use, whether long request paths can reach the router, and whether request-size limits or upstream proxies permit paths far beyond 4096 bytes. The observed crash occurred around 24,000 consecutive slashes in a native libstdc++ build, but the exact threshold depends on stack size and standard library behavior.