Pistache uses a standard regular‑expression replace to collapse consecutive slashes during path normalization. In libstdc++, the regular‑expression engine recurses deeply when confronted with a path containing thousands of consecutive slash characters, eventually exhausting the thread stack and crashing the process. This flaw is a form of uncontrolled resource consumption (CWE‑400) compounded by a recursion that can lead to infinite stack growth (CWE‑674). The result is an unauthenticated denial‑of‑service, as the server or any component that processes the path will terminate when the stack limit is reached.

The issue affects Pistache IO’s REST toolkit in versions 0.0.5 through 0.4.26. Any deployment that uses SegmentTreeNode::sanitizeResource() in the router, either through HTTP request handling or direct router API use, is vulnerable. The vulnerability is driven by the depth of the stack used by the standard library’s regex engine and is only triggered by sufficiently long request paths, which can be controlled by the client if the server allows a max request size larger than 4096 bytes or if a front‑end forwards long paths.

The CVSS score of 5.9 indicates a moderate severity. The EPSS score is currently unavailable, and the flaw is not listed in CISA’s KEV catalog, but the exploitability remains realistic on systems that allow long paths. An attacker can trigger the crash by sending a hostile HTTP request with an excessively long sequence of slashes, potentially via a public endpoint or through a reverse proxy that strips or forwards long paths. The crash comes from stack exhaustion rather than memory corruption, so the risk is confined to service availability and does not directly lead to code execution or data disclosure.