{"id":"CVE-2026-62303","kind":"vulnerability","aliases":["CVE-2026-62303"],"related":[],"title":"Pistache C++ REST toolkit: long slash paths crash the process","description":"Pistache is a high-performance REST toolkit written in C++. From 0.0.5 through 0.4.26, `SegmentTreeNode::sanitizeResource()` in `src/server/router.cc` uses `std::regex_replace()` with the `//+` expression to collapse consecutive slashes. With libstdc++, a path containing tens of thousands of consecutive slash characters can recurse deeply enough to exhaust the stack and crash the process. `Router::route()`, `Router::addRoute()` and `Router::removeRoute()` reach this normalization. Unauthenticated remote exploitation is conditional on a deployment allowing sufficiently long request paths, such as by increasing `Endpoint::Options::maxRequestSize()` above the default 4096-byte limit or forwarding long paths through a front end. Direct router API use is also affected when attacker-controlled route or resource strings reach the normalizer. Native builds reproduced a crash around 24,000 consecutive slashes, although the exact threshold depends on the stack and standard library; the demonstrated failure is stack exhaustion rather than uninitialized-memory use. A source fix replaces recursive regular-expression normalization with an iterative pass, but no containing repository release was verified as of time of publication.","summary":"Pistache's router collapses consecutive slashes in request paths with a regular expression that recurses on libstdc++, so a path with tens of thousands of slashes exhausts the stack. An unauthenticated remote attacker can crash the server process (denial of service) when the deployment allows long request paths.","severity":"medium","cvss":5.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["c++","package","pistache","self-hosted"],"not_affected_if":["default-config","no-long-paths-forwarded"],"how_to_check":"- Check the Pistache version in use against the affected range 0.0.5 through 0.4.26.\n- Check whether `Endpoint::Options::maxRequestSize()` is raised above the default `4096` bytes, or whether a front end forwards long paths to the service.\n- Check whether attacker-controlled strings reach `Router::addRoute()`, `Router::removeRoute()` or `Router::route()` through the direct router API.","fix":"- Pistache: move past `0.4.26`; the sources say a source fix replaces the recursive normalization with an iterative pass, but no released version containing it was verified at publication.","status":"open","published_at":"2026-10-30T19:18:33+00:00","first_seen_at":"2026-10-30T19:25:30+00:00","triaged_at":"2026-10-30T19:26:31+00:00","updated_at":"2026-10-30T19:26:31+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-30T19:26:31Z","model":"claude-haiku-5-5","output":{"fix":"- Pistache: move past `0.4.26`; the sources say a source fix replaces the recursive normalization with an iterative pass, but no released version containing it was verified at publication.","reach":"internet","title":"Pistache C++ REST toolkit: long slash paths crash the process","impact":"low","summary":"Pistache's router collapses consecutive slashes in request paths with a regular expression that recurses on libstdc++, so a path with tens of thousands of slashes exhausts the stack. An unauthenticated remote attacker can crash the server process (denial of service) when the deployment allows long request paths.","audience":"developers","category":"package","nicknames":[],"who_cares":["pistache","c++","self-hosted"],"confidence":0.7,"fix_status":"unknown","needs_auth":"no","worst_case":"Server process crashes from stack exhaustion, causing denial of service","analyst_note":"Confirm whether any released Pistache version contains the iterative normalization fix; sources say none was verified at publication.","how_to_check":"- Check the Pistache version in use against the affected range 0.0.5 through 0.4.26.\n- Check whether `Endpoint::Options::maxRequestSize()` is raised above the default `4096` bytes, or whether a front end forwards long paths to the service.\n- Check whether attacker-controlled strings reach `Router::addRoute()`, `Router::removeRoute()` or `Router::route()` through the direct router API.","plain_action":"","needs_analyst":true,"not_affected_if":["default-config","no-long-paths-forwarded"],"who_is_affected":"Services built on Pistache 0.0.5 through 0.4.26 are exposed when long request paths can reach the router, which happens when maxRequestSize is raised above 4096 bytes or a front end forwards long paths. Applications that use only the default request size limit and do not pass attacker-controlled strings into the router API are less exposed. The sources do not say which released version contains the fix.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000795,"input_tokens":4425,"output_tokens":704,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-62303':13A,16A '0.0.5':83C '0.4.26':85C '000':194C '24':193C '4096':158C 'addrout':128C 'affect':175C 'allow':67B,143C 'also':174C 'although':197C 'api':171C 'around':192C 'attack':55B,178C 'attacker-control':177C 'build':188C 'byte':159C 'c':2A,17B,81C 'charact':112C 'collaps':26B,98C 'condit':139C 'consecut':27B,99C,110C,195C 'contain':105C,235C 'control':179C 'crash':8A,57B,122C,191C 'cve':11A,14A 'deepli':115C 'default':157C 'demonstr':209C 'denial':61B 'depend':201C 'deploy':66B,142C 'direct':169C 'end':168C 'endpoint':152C 'enough':116C 'exact':199C 'exhaust':49B,118C,213C 'exploit':137C 'express':35B,96C,227C 'failur':210C 'fix':222C 'forward':162C 'front':167C 'high':75C 'high-perform':74C 'host':22B 'increas':151C 'iter':231C 'librari':207C 'libstdc':39B,102C 'limit':160C 'long':5A,68B,145C,163C 'maxrequests':154C 'memori':218C 'nativ':187C 'normal':134C,186C,228C 'option':153C 'packag':18B 'pass':232C 'path':7A,31B,42B,70B,104C,147C,164C 'perform':76C 'pistach':1A,19B,23B,71C 'process':10A,60B,124C 'public':244C 'rather':214C 'reach':132C,184C 'recurs':37B,114C,224C 'regex':92C 'regular':34B,226C 'regular-express':225C 'releas':237C 'remot':54B,136C 'removerout':131C 'replac':93C,223C 'repositori':236C 'reproduc':189C 'request':30B,69B,146C 'resourc':182C 'rest':3A,77C 'rout':126C,180C 'router':25B,125C,127C,130C,170C 'sanitizeresourc':87C 'segmenttreenod':86C 'self':21B 'self-host':20B 'server':59B 'servic':63B 'slash':6A,28B,48B,100C,111C,196C 'sourc':221C 'src/server/router.cc':89C 'stack':51B,120C,204C,212C 'standard':206C 'std':91C 'string':183C 'suffici':144C 'ten':44B,106C 'thousand':46B,108C 'threshold':200C 'time':242C 'toolkit':4A,78C 'unauthent':53B,135C 'uniniti':217C 'uninitialized-memori':216C 'use':90C,172C,219C 'verifi':239C 'written':79C","nicknames":[],"mitigations":[],"who_affected":"Services built on Pistache 0.0.5 through 0.4.26 are exposed when long request paths can reach the router, which happens when maxRequestSize is raised above 4096 bytes or a front end forwards long paths. Applications that use only the default request size limit and do not pass attacker-controlled strings into the router API are less exposed. The sources do not say which released version contains the fix.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"developers","plain_action":null,"first_public_at":"2026-10-30T19:18:33+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-62303","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-62303","severity":null,"published_at":"2026-10-30T19:18:33+00:00","modified_at":"2026-10-30T19:18:33+00:00","first_seen_at":"2026-10-30T19:25:30+00:00","fetched_at":"2026-10-30T19:25:30+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}