Hi,

The following vulnerability was published for pistache.

CVE-2026-62303[0]:
| Pistache is a high-performance REST toolkit written in C++. From
| 0.0.5 through 0.4.26, `SegmentTreeNode::sanitizeResource()` in
| `src/server/router.cc` uses `std::regex_replace()` with the `//+`
| expression to collapse consecutive slashes. With libstdc++, a path
| containing tens of thousands of consecutive slash characters can
| recurse deeply enough to exhaust the stack and crash the process.
| `Router::route()`, `Router::addRoute()` and `Router::removeRoute()`
| reach this normalization. Unauthenticated remote exploitation is
| conditional on a deployment allowing sufficiently long request
| paths, such as by increasing `Endpoint::Options::maxRequestSize()`
| above the default 4096-byte limit or forwarding long paths through a
| front end. Direct router API use is also affected when attacker-
| controlled route or resource strings reach the normalizer. Native
| builds reproduced a crash around 24,000 consecutive slashes,
| although the exact threshold depends on the stack and standard
| library; the demonstrated failure is stack exhaustion rather than
| uninitialized-memory use. A source fix replaces recursive regular-
| expression normalization with an iterative pass, but no containing
| repository release was verified as of time of publication.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-62303
https://www.cve.org/CVERecord?id=CVE-2026-62303
[1] https://github.com/pistacheio/pistache/security/advisories/GHSA-q474-pqcp-gqm5
[2] https://github.com/pistacheio/pistache/commit/935461352403696f3ca0dbb9a7de7d2609e7ce91

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore