Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-62303— Pistache: DoS via stack exhaustion in REST router path normalization (regex_replace on long slash runs)

Quick assessment

Affected
pistacheio pistache
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Pistache 是一个用 C++ 编写的高性能 REST 工具包。在 0.0.5 至 0.4.26 版本中， 中的 函数使用 配合 正则表达式来合并连续的斜杠。当使用 libstdc++ 时，若路径包含数万个连续斜杠字符，可能导致递归深度过大，从而耗尽栈空间并引发进程崩溃。 、 和 均会调用该规范化逻辑。未认证的远程利用需要部署环境允许足够长的请求路径，例如通过提高 的默认 4096 字节限制，或通过前端转发长路径。当攻击者能够控制路由或资源字符串并传入规范化器时，直接调用路由器 API 也会受到影响。在原生构建

CVSS 5.9 · Medium

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

Affected Version Matrix 1

VendorProduct Version RangeStatus
pistacheio pistache >= 0.0.5, <= 0.4.26 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-62303

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Pistache: DoS via stack exhaustion in REST router path normalization (regex_replace on long slash runs)
Source: CVE Program / CVE List V5
Vulnerability Description
Pistache is a high-performance REST toolkit written in C++. From 0.0.5 through 0.4.26, `SegmentTreeNode::sanitizeResource()` in `src/server/router.cc` uses `std::regex_replace()` with the `//+` expression to collapse consecutive slashes. With libstdc++, a path containing tens of thousands of consecutive slash characters can recurse deeply enough to exhaust the stack and crash the process. `Router::route()`, `Router::addRoute()` and `Router::removeRoute()` reach this normalization. Unauthenticated remote exploitation is conditional on a deployment allowing sufficiently long request paths, such as by increasing `Endpoint::Options::maxRequestSize()` above the default 4096-byte limit or forwarding long paths through a front end. Direct router API use is also affected when attacker-controlled route or resource strings reach the normalizer. Native builds reproduced a crash around 24,000 consecutive slashes, although the exact threshold depends on the stack and standard library; the demonstrated failure is stack exhaustion rather than uninitialized-memory use. A source fix replaces recursive regular-expression normalization with an iterative pass, but no containing repository release was verified as of time of publication.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
未加控制的资源消耗(资源穷尽)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
pistacheio pistache >= 0.0.5, <= 0.4.26 -

II. Public POCs for CVE-2026-62303

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-62303

请登录查看更多情报信息。

Other References for CVE-2026-62303 (2)

IV. Related Vulnerabilities

Same weakness: CWE-400