CVE-2026-61845 · GHSA-6wmf-3r64-vcwv
Crass : Large numeric exponents cause CPU and memory denial of service
- Risk score
- 58/100
- CVSS
- 8.9 v4.0
- Published
- 20 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- Crass converts CSS scientific notation number values with unbounded exponentiation before it clamps the result to Float::MAX. Applications that use Crass to parse attacker-controlled CSS strings can be forced to spend disproportionate CPU and memory parsing a tiny input, possibly resulting in a crash. This is fixed in…
- Affected
- crass (rubygems) < 1.0.7
- Fix
- Upgrade crass to 1.0.7 or later.
- Exploitation
- No known exploitation
Why it is Yellow
- CVSS 8.9 high
- Remotely exploitable without logging in
Affected packages
| Package | Ecosystem | Vulnerable | Fixed in |
|---|---|---|---|
| crass | rubygems | < 1.0.7 | 1.0.7 |
References
- https://github.com/advisories/GHSA-6wmf-3r64-vcwv
- https://github.com/rgrove/crass/security/advisories/GHSA-6wmf-3r64-vcwv
- https://github.com/rgrove/crass/releases/tag/v1.0.7
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/crass/GHSA-6wmf-3r64-vcwv.yml
- https://rubygems.org/gems/crass/versions/1.0.7
- https://github.com/advisories/GHSA-6wmf-3r64-vcwv
Original description
### Impact Crass converts CSS scientific notation number values with unbounded exponentiation before it clamps the result to `Float::MAX`. Applications that use Crass to parse attacker-controlled CSS strings can be forced to spend disproportionate CPU and memory parsing a tiny input, possibly resulting in a crash. ### Patches This is fixed in Crass 1.0.7. ### Related - https://github.com/rubysec/ruby-advisory-db/blob/master/gems/crass/GHSA-6wmf-3r64-vcwv.yml
Last activity 20 Oct 2026. Patch Forecast updates every hour.