pistache - Debian Package Tracker

general

source: pistache (main)
version: 0.4.26+ds-3
maintainer: Andrea Pappacoda (DMD)
arch: any
std-ver: 4.7.0
VCS: Git (Browse, QA)

versions [more versions can be listed by madison] [old versions available from snapshot.debian.org]

[pool directory]

oldstable: 0.0.5+ds-3
stable: 0.0.5+ds-5.1
testing: 0.4.26+ds-3
unstable: 0.4.26+ds-3

versioned links

0.0.5+ds-3: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
0.0.5+ds-5.1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
0.4.26+ds-3: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]

binaries

libpistache-dev
libpistache0.4

action needed

1 security issue in trixie high

There is 1 open security issue in trixie.

1 important issue:

CVE-2026-62303: Pistache is a high-performance REST toolkit written in C++. From 0.0.5 through 0.4.26, `SegmentTreeNode::sanitizeResource()` in `src/server/router.cc` uses `std::regex_replace()` with the `//+` expression to collapse consecutive slashes. With libstdc++, a path containing tens of thousands of consecutive slash characters can recurse deeply enough to exhaust the stack and crash the process. `Router::route()`, `Router::addRoute()` and `Router::removeRoute()` reach this normalization. Unauthenticated remote exploitation is conditional on a deployment allowing sufficiently long request paths, such as by increasing `Endpoint::Options::maxRequestSize()` above the default 4096-byte limit or forwarding long paths through a front end. Direct router API use is also affected when attacker-controlled route or resource strings reach the normalizer. Native builds reproduced a crash around 24,000 consecutive slashes, although the exact threshold depends on the stack and standard library; the demonstrated failure is stack exhaustion rather than uninitialized-memory use. A source fix replaces recursive regular-expression normalization with an iterative pass, but no containing repository release was verified as of time of publication.

Created: 2026-10-31 Last update: 2026-10-31 15:20

1 security issue in sid high

There is 1 open security issue in sid.

1 important issue:

CVE-2026-62303: Pistache is a high-performance REST toolkit written in C++. From 0.0.5 through 0.4.26, `SegmentTreeNode::sanitizeResource()` in `src/server/router.cc` uses `std::regex_replace()` with the `//+` expression to collapse consecutive slashes. With libstdc++, a path containing tens of thousands of consecutive slash characters can recurse deeply enough to exhaust the stack and crash the process. `Router::route()`, `Router::addRoute()` and `Router::removeRoute()` reach this normalization. Unauthenticated remote exploitation is conditional on a deployment allowing sufficiently long request paths, such as by increasing `Endpoint::Options::maxRequestSize()` above the default 4096-byte limit or forwarding long paths through a front end. Direct router API use is also affected when attacker-controlled route or resource strings reach the normalizer. Native builds reproduced a crash around 24,000 consecutive slashes, although the exact threshold depends on the stack and standard library; the demonstrated failure is stack exhaustion rather than uninitialized-memory use. A source fix replaces recursive regular-expression normalization with an iterative pass, but no containing repository release was verified as of time of publication.

Created: 2026-10-31 Last update: 2026-10-31 15:20

1 security issue in forky high

There is 1 open security issue in forky.

1 important issue:

CVE-2026-62303: Pistache is a high-performance REST toolkit written in C++. From 0.0.5 through 0.4.26, `SegmentTreeNode::sanitizeResource()` in `src/server/router.cc` uses `std::regex_replace()` with the `//+` expression to collapse consecutive slashes. With libstdc++, a path containing tens of thousands of consecutive slash characters can recurse deeply enough to exhaust the stack and crash the process. `Router::route()`, `Router::addRoute()` and `Router::removeRoute()` reach this normalization. Unauthenticated remote exploitation is conditional on a deployment allowing sufficiently long request paths, such as by increasing `Endpoint::Options::maxRequestSize()` above the default 4096-byte limit or forwarding long paths through a front end. Direct router API use is also affected when attacker-controlled route or resource strings reach the normalizer. Native builds reproduced a crash around 24,000 consecutive slashes, although the exact threshold depends on the stack and standard library; the demonstrated failure is stack exhaustion rather than uninitialized-memory use. A source fix replaces recursive regular-expression normalization with an iterative pass, but no containing repository release was verified as of time of publication.

Created: 2026-10-31 Last update: 2026-10-31 15:20

1 security issue in bookworm high

There is 1 open security issue in bookworm.

1 important issue:

CVE-2026-62303: Pistache is a high-performance REST toolkit written in C++. From 0.0.5 through 0.4.26, `SegmentTreeNode::sanitizeResource()` in `src/server/router.cc` uses `std::regex_replace()` with the `//+` expression to collapse consecutive slashes. With libstdc++, a path containing tens of thousands of consecutive slash characters can recurse deeply enough to exhaust the stack and crash the process. `Router::route()`, `Router::addRoute()` and `Router::removeRoute()` reach this normalization. Unauthenticated remote exploitation is conditional on a deployment allowing sufficiently long request paths, such as by increasing `Endpoint::Options::maxRequestSize()` above the default 4096-byte limit or forwarding long paths through a front end. Direct router API use is also affected when attacker-controlled route or resource strings reach the normalizer. Native builds reproduced a crash around 24,000 consecutive slashes, although the exact threshold depends on the stack and standard library; the demonstrated failure is stack exhaustion rather than uninitialized-memory use. A source fix replaces recursive regular-expression normalization with an iterative pass, but no containing repository release was verified as of time of publication.

Created: 2026-10-31 Last update: 2026-10-31 15:20

Failed to analyze the VCS repository. Please troubleshoot and fix the issue. high

vcswatch reports that there is an error with this package's VCS, or the debian/changelog file inside it. Please check the error shown below and try to fix it. You might have to update the VCS URL in the debian/control file to point to the correct repository.

fatal: could not read Username for 'https://salsa.debian.org': No such device or address

Created: 2023-02-02 Last update: 2026-10-30 21:01

lintian reports 3 warnings normal

Lintian reports 3 warnings about this package. You should make the package lintian clean getting rid of them.

Created: 2024-03-01 Last update: 2026-02-28 15:00

Standards version of the package is outdated. wishlist

The package should be updated to follow the last version of Debian Policy (Standards-Version 4.7.4 instead of 4.7.0).

Created: 2024-04-07 Last update: 2026-03-31 15:01

testing migrations

This package will soon be part of the auto-openssl transition. You might want to ensure that your package is ready for it. You can probably find supplementary information in the debian-release archives or in the corresponding release.debian.org bug.

news

[rss feed]

[2025-09-21] pistache 0.4.26+ds-3 MIGRATED to testing (Debian testing watch)
[2025-09-18] Accepted pistache 0.4.26+ds-3 (source) into unstable (Andrea Pappacoda)
[2024-12-30] Accepted pistache 0.4.26+ds-2 (amd64 source) into experimental (Debian FTP Masters) (signed by: Andrea Pappacoda)
[2024-05-03] pistache 0.0.5+ds-5.1 MIGRATED to testing (Debian testing watch)
[2024-03-17] pistache REMOVED from testing (Debian testing watch)
[2024-02-29] Accepted pistache 0.0.5+ds-5.1 (source) into unstable (Benjamin Drung)
[2024-02-05] Accepted pistache 0.0.5+ds-5.1~exp1 (source) into experimental (Lucas Kanashiro)
[2023-08-01] pistache 0.0.5+ds-5 MIGRATED to testing (Debian testing watch)
[2023-07-15] Accepted pistache 0.0.5+ds-5 (source) into unstable (Andrea Pappacoda)
[2023-07-03] pistache 0.0.5+ds-4 MIGRATED to testing (Debian testing watch)
[2023-06-23] Accepted pistache 0.0.5+ds-4 (source) into unstable (Andrea Pappacoda)
[2023-03-28] pistache 0.0.5+ds-3 MIGRATED to testing (Debian testing watch)
[2023-03-08] Accepted pistache 0.0.5+ds-3 (source) into unstable (Andrea Pappacoda)
[2023-02-06] pistache 0.0.5+ds-2 MIGRATED to testing (Debian testing watch)
[2023-02-04] Accepted pistache 0.0.5+ds-2 (source) into unstable (Andrea Pappacoda)
[2023-02-02] Accepted pistache 0.0.5+ds-1 (source amd64) into unstable (Debian FTP Masters) (signed by: Stephan Lachnit)

bugs [bug history graph]

all: 2
RC: 0
I&N: 1
M&W: 1
F&P: 0
patch: 0

links

homepage
lintian (0, 3)
buildd: logs, reproducibility, cross
popcon
browse source code
other distros
security tracker
debci