Stack Exhaustion Vulnerability in Pistache REST Toolkit

CVE-2026-62303

What is CVE-2026-62303?

A vulnerability in Pistache, a C++ REST toolkit, allows attackers to exploit deep recursion due to improper handling of consecutive slashes in request paths. This issue arises from the SegmentTreeNode::sanitizeResource() function, which uses std::regex_replace() to normalize paths. In scenarios where long request paths are allowed (for instance, by modifying maxRequestSize()), an attacker can send deeply nested requests that may exhaust the stack, crashing the application. The exploit is particularly dangerous in environments where direct API calls are made using attacker-controlled input, thus leading to potential denial of service attacks.

References