Source: pistache Version: 0.4.26+ds-3 X-Debbugs-CC: [email protected] Severity: important Tags: security upstream
Hi, The following vulnerability was published for pistache. CVE-2026-62303[0]: | Pistache is a high-performance REST toolkit written in C++. From | 0.0.5 through 0.4.26, `SegmentTreeNode::sanitizeResource()` in | `src/server/router.cc` uses `std::regex_replace()` with the `//+` | expression to collapse consecutive slashes. With libstdc++, a path | containing tens of thousands of consecutive slash characters can | recurse deeply enough to exhaust the stack and crash the process. | `Router::route()`, `Router::addRoute()` and `Router::removeRoute()` | reach this normalization. Unauthenticated remote exploitation is | conditional on a deployment allowing sufficiently long request | paths, such as by increasing `Endpoint::Options::maxRequestSize()` | above the default 4096-byte limit or forwarding long paths through a | front end. Direct router API use is also affected when attacker- | controlled route or resource strings reach the normalizer. Native | builds reproduced a crash around 24,000 consecutive slashes, | although the exact threshold depends on the stack and standard | library; the demonstrated failure is stack exhaustion rather than | uninitialized-memory use. A source fix replaces recursive regular- | expression normalization with an iterative pass, but no containing | repository release was verified as of time of publication. If you fix the vulnerability please also make sure to include the CVE (Common Vulnerabilities & Exposures) id in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2026-62303 https://www.cve.org/CVERecord?id=CVE-2026-62303 [1] https://github.com/pistacheio/pistache/security/advisories/GHSA-q474-pqcp-gqm5 [2] https://github.com/pistacheio/pistache/commit/935461352403696f3ca0dbb9a7de7d2609e7ce91 Please adjust the affected versions in the BTS as needed. Regards, Salvatore
