Live › vulnerability › CVE-2026-62303
Pistache's router collapses consecutive slashes in request paths with a regular expression that recurses on libstdc++, so a path with tens of thousands of slashes exhausts the stack. An unauthenticated remote attacker can crash the server process (denial of service) when the deployment allows long request paths.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 19:25 UTC. All times on this page are UTC.
Services built on Pistache 0.0.5 through 0.4.26 are exposed when long request paths can reach the router, which happens when maxRequestSize is raised above 4096 bytes or a front end forwards long paths. Applications that use only the default request size limit and do not pass attacker-controlled strings into the router API are less exposed. The sources do not say which released version contains the fix.
No product ranges from the sources yet.
Endpoint::Options::maxRequestSize() is raised above the default 4096 bytes, or whether a front end forwards long paths to the service.Router::addRoute(), Router::removeRoute() or Router::route() through the direct router API.0.4.26; the sources say a source fix replaces the recursive normalization with an iterative pass, but no released version containing it was verified at publication.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Pistache is a high-performance REST toolkit written in C++. From 0.0.5 through 0.4.26, SegmentTreeNode::sanitizeResource() in src/server/router.cc uses std::regex_replace() with the //+ expression to collapse consecutive slashes. With libstdc++, a path containing tens of thousands of consecutive slash characters can recurse deeply enough to exhaust the stack and crash the process. Router::route(), Router::addRoute() and Router::removeRoute() reach this normalization. Unauthenticated remote exploitation is conditional on a deployment allowing sufficiently long request paths, such as by increasing Endpoint::Options::maxRequestSize() above the default 4096-byte limit or forwarding long paths through a front end. Direct router API use is also affected when attacker-controlled route or resource strings reach the normalizer. Native builds reproduced a crash around 24,000 consecutive slashes, although the exact threshold depends on the stack and standard library; the demonstrated failure is stack exhaustion rather than uninitialized-memory use. A source fix replaces recursive regular-expression normalization with an iterative pass, but no containing repository release was verified as of time of publication.
This page as .md · .json · in your agent: get_signal("CVE-2026-62303")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.