EUVD-2026-114262Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessSend HTTP request with ~24k consecutive slashes
-
ExploitReach SegmentTreeNode::sanitizeResource() normalization
-
ExecutionTrigger deep libstdc++ regex recursion
-
ImpactExhaust thread stack and crash process (SIGSEGV)
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V2 - Validation and Business Logic Resource consumption limits
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires that the deployment accept request paths long enough to hold tens of thousands of consecutive '/' characters (reproduced around 24,000). Concretely this means one of: Endpoint::Options::maxRequestSize() raised above the default 4096-byte limit; a front end (reverse proxy/load balancer) that forwards very long paths to Pistache; or direct use of the router API (Router::route(), Router::addRoute(), Router::removeRoute(), or SegmentTreeNode::sanitizeResource()) where attacker-controlled route or resource strings reach the normalizer. The primary LIMITING factor is the default 4096-byte request-size cap, which blocks the ~24k-slash path on an unmodified default server, making this a conditional rather than default remote crash. The crash is further tied to libstdc++'s recursive std::regex implementation and the exact threshold varies with stack size and standard-library build, so impact is environment-dependent. No authentication is required (PR:N), and impact is confined to process availability. |
| Impact | This is a conditional availability-only denial of service (CWE-400/CWE-674 uncontrolled recursion) rated CVSS 5.9. The supplied vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H is internally consistent with the evidence: network-reachable (AV:N), unauthenticated (PR:N), no user interaction, impact limited to availability (C:N/I:N/A:H), and AC:H reflecting that exploitation depends on a non-default deployment and a stack/libstdc++-specific crash threshold rather than attacker skill. No EPSS score and no CISA KEV entry were provided, and the vuln.today Decision label is 'this_month' (not act_now/emergency), which aligns with a conditional, non-default-path DoS rather than an urgent widely-exploitable flaw. The key tension to flag explicitly: the CVSS vector shows AV:N/PR:N (remote unauthenticated), but the GHSA advisory and description make clear that default deployments are protected by the 4096-byte request-size limit, so the practical network exposure exists ONLY when maxRequestSize is raised above default, a front end forwards very long paths, or attacker-controlled strings reach the router API directly - the vector does not capture that environmental precondition. There is no EPSS or KEV signal to weigh, so prioritization rests on SSVC-style reasoning: technical impact is availability-only (process crash, no RCE or data exposure) and automatability is limited by the non-default configuration requirement. Net: a genuine but configuration-gated DoS - worth patching on a normal cycle for affected deployments, not a default remote-crash emergency. |
| Exploit ScenarioDerived | A Pistache-based REST server is deployed with Endpoint::Options::maxRequestSize() raised above the default 4096 bytes (or sits behind a proxy that forwards very long paths). An unauthenticated remote attacker sends a single GET request whose path contains roughly 24,000 consecutive '/' characters; libstdc++'s std::regex_replace over the '//+' pattern recurses deeply during router path normalization, exhausts the thread stack, and terminates the process with SIGSEGV. The GHSA advisory publishes full PoC source (end-to-end server, direct sanitizeResource(), and parser paths) with build/run steps, demonstrated by the reporter in clean native Meson/g++ builds. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 30, 2026
Uncontrolled stack recursion in Pistache's REST router path normalization lets a request path containing tens of thousands of consecutive '/' characters exhaust a thread's stack and terminate the server process with SIGSEGV. Pistache 0.0.5 through 0.4.26 and current master are affected; the reporter reproduced an end-to-end crash at roughly 24,000 consecutive slashes against a minimal server configured with maxRequestSize(200000), and also reproduced it through direct calls to SegmentTreeNode::sanitizeResource() and through a parsed HTTP request path. Impact is conditional rather than a default remote crash: the default 4096-byte request-size cap blocks the pathological path unless maxRequestSize() is raised, a front end forwards very long paths, or attacker-controlled strings reach the router API; the GitHub advisory ships a working proof-of-concept with full reproduction steps, the issue is not listed in CISA KEV, and remote exploitation requires no authentication (PR:N).
RemediationAI
Upstream fix available (PR/commit); released patched version not independently confirmed - apply commit 935461352403696f3ca0dbb9a7de7d2609e7ce91 (https://github.com/pistacheio/pistache/commit/935461352403696f3ca0dbb9a7de7d2609e7ce91), which deletes the static std::regex multiple_slash member and the <regex> include in include/pistache/router.h and rewrites SegmentTreeNode::sanitizeResource() as an iterative slash-collapsing loop; no containing Pistache release was verified as of publication, so builds from a release tag remain vulnerable until the commit is carried. If the patch cannot be applied immediately, keep Endpoint::Options::maxRequestSize() at its 4096-byte default (the reproduced crash needed roughly 24,000 slashes, so the default cap blocks the demonstrated payload - but any deployment that deliberately raised the limit must lower it again), and if a reverse proxy or load balancer fronts Pistache, configure it to reject or normalize request targets containing long slash runs and to cap URI length before forwarding, since such a front end is itself one of the conditions that creates exposure. Applications that pass attacker-controlled route or resource strings into Router::addRoute(), Router::removeRoute() or SegmentTreeNode::sanitizeResource() must sanitize or length-limit those strings before they reach the normalizer. Each workaround trades functionality or legitimate long-URL support for reduced exposure and none of them removes the underlying recursion, so the commit remains the only complete fix.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw sits in SegmentTreeNode::sanitizeResource() in src/server/router.cc, which normalizes router paths by calling std::regex_replace() with the compiled pattern "//+" (std::regex_constants::optimize) to collapse consecutive forward slashes the way nginx, httpd and IIS do. Under libstdc++, the regular-expression engine handles a long run of slashes recursively, so a path with tens of thousands of consecutive '/' characters drives deep enough recursion to exhaust the stack - an instance of CWE-400 (uncontrolled resource consumption) with the more specific CWE-674 (uncontrolled recursion) classification used by the advisory. The normalizer is reached from Router::route(), Router::addRoute() and Router::removeRoute(), and the behavior was introduced with commit 38d52d9 (2018-09-28, PR #306) when the router moved to a tree-based implementation and slash collapsing was added, so every checked release containing that commit (0.0.5, v0.4.23, v0.4.25, v0.4.26) plus master cbdb91d0 is affected. The reporter explicitly distinguished this from a memory-safety bug: the demonstrated failure is stack exhaustion, not uninitialized-memory use, and the exact threshold varies with stack size and standard-library build (native builds crashed around 24,000 slashes, earlier Docker builds crashed at higher counts). The fix commit removes the static std::regex member and the <regex> include from include/pistache/router.h and replaces the regex call with a single iterative pass that reserves capacity and pushes characters while skipping runs of '/', eliminating recursion entirely.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Remote unauthenticated availability-only DoS; AC:H reflects dependence on a non-default large request-size configuration and a stack/libstdc++-specific crash threshold; no confidentiality or integrity impact.
Primary rating from Vendor (github).
CVSS VectorVendor: github
DescriptionCVE.org
Pistache is a high-performance REST toolkit written in C++. From 0.0.5 through 0.4.26, SegmentTreeNode::sanitizeResource() in src/server/router.cc uses std::regex_replace() with the //+ expression to collapse consecutive slashes. With libstdc++, a path containing tens of thousands of consecutive slash characters can recurse deeply enough to exhaust the stack and crash the process. Router::route(), Router::addRoute() and Router::removeRoute() reach this normalization. Unauthenticated remote exploitation is conditional on a deployment allowing sufficiently long request paths, such as by increasing Endpoint::Options::maxRequestSize() above the default 4096-byte limit or forwarding long paths through a front end. Direct router API use is also affected when attacker-controlled route or resource strings reach the normalizer. Native builds reproduced a crash around 24,000 consecutive slashes, although the exact threshold depends on the stack and standard library; the demonstrated failure is stack exhaustion rather than uninitialized-memory use. A source fix replaces recursive regular-expression normalization with an iterative pass, but no containing repository release was verified as of time of publication.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Exploit-DB