Pistache is a high-performance REST toolkit written in C++. From 0.0.5 through 0.4.26, SegmentTreeNode::sanitizeResource() in src/server/router.cc uses std::regex_replace() with the //+ expression to collapse consecutive slashes. With libstdc++, a path containing tens of thousands of consecutive slash characters can recurse deeply enough to exhaust the stack and crash the process. Router::route(), Router::addRoute() and Router::removeRoute() reach this normalization. Unauthenticated remote exploitation is conditional on a deployment allowing sufficiently long request paths, such as by increasing Endpoint::Options::maxRequestSize() above the default 4096-byte limit or forwarding long paths through a front end. Direct router API use is also affected when attacker-controlled route or…