SZB-c774d61fb4
EUVD-2026-114262: Pistache sanitizeResource flaw affects versions 0.0.5 through 0.4.26
- Status
- Unverified: only social posts report this so far
- Kind
- Vulnerability
- Vendor
- pistacheio
- Product
- Pistache
- First seen
Summary
The EUVD entry, scored 5.9/10 (CVSS v3.1), describes a flaw in Pistache's sanitizeResource() routine, which uses std::regex_replace() to collapse slashes. The item is truncated and does not state the full impact.
If you use pistacheio
Upgrade Pistache to a release later than 0.4.26 once a fixed version is confirmed
Read the full EUVD record for impact details
Check whether your REST routing relies on the affected path sanitization
What the sources say 1
· Mastodon: “From 0.0.5 through 0.4.26, `SegmentTreeNode::sanitizeResource()` in `src/server/router.cc` uses `std::regex_replace()` with the `//+` expression to collapse consecutive slashes.” Source