CVE-2026-62303 Pistache: DoS via stack exhaustion in REST router path normalization (regex_replace on long slash runs)

Pistache is a high-performance REST toolkit written in C++. From 0.0.5 through 0.4.26, SegmentTreeNode::sanitizeResource in src/server/router.cc uses std::regexreplace with the //+ expression to collapse consecutive slashes. With libstdc++, a path containing tens of thousands of consecutive slash...

CVE-2026-62303

The Pistache REST toolkit (versions 0.0.5 through 0.4.26 ) is vulnerable to a Denial of Service (DoS) via stack exhaustion. The root cause is located in src/server/router.cc within the SegmentTreeNode::sanitizeResource() function, which uses std::regex_replace() with the //+ expression to collaps...