CVE-2026-61846 · GHSA-6jxj-px6v-747w
Crass: Deeply nested CSS blocks and functions can trigger a SystemStackError or excessive memory usage
- Risk score
- 46/100
- CVSS
- 6.3 v4.0
- Exploit chance (30 days)
- 0.5%
- Published
- 29 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- Crass is a Ruby CSS parser that's fully compliant with the CSS Syntax Level 3 specification. Prior to 1.0.7, Crass recursively parses CSS simple blocks and functions without a depth guard. An attacker-controlled CSS value containing deeply nested blocks or functions can recurse until Ruby raises SystemStackError: stac…
- Affected
- crass (rubygems) < 1.0.7
- Fix
- Upgrade crass to 1.0.7 or later.
- Exploitation
- No known exploitation
Story map
At a glance
crass: Amber, patch this week. Crass, a Ruby CSS parser, is vulnerable to a denial of service attack due to unbounded exponentiation in scientific notation number values. An attacker can cause a disproportionate CPU and memory usage, potentially resulting in a crash.
The flaws
- CVE-2026-61846: Crass: Deeply nested CSS blocks and functions can trigger a SystemStackError or excessive memory usage (CVSS 6.3 · EPSS 0%)
- CVE-2026-61845: Crass : Large numeric exponents cause CPU and memory denial of service (CVSS 8.9 · EPSS 0%)
- CVE-2026-61848: Crass: Non-ASCII characters cause superlinear CPU consumption (CVSS 6.3 · EPSS 0%)
- CVE-2026-61847: Crass: A large number of adjacent CSS comments can trigger a SystemStackError (CVSS 6.3 · EPSS 0%)
The fix
Upgrade crass: 1.0.7 or later on your release line
Who is exposed: {'products': ['Crass'], 'packages': ['crass'], 'versions': ['< 1.0.7']}
Where it stands
- No known exploitation
Connects to
- Same weakness: Denial of service (CWE-400). 313 other warnings in 30 days
Why it is Yellow
- CVSS 6.3 medium
Affected packages
| Package | Ecosystem | Vulnerable | Fixed in |
|---|---|---|---|
| crass | rubygems | < 1.0.7 | 1.0.7 |
References
Original description
Crass is a Ruby CSS parser that's fully compliant with the CSS Syntax Level 3 specification. Prior to 1.0.7, Crass recursively parses `CSS simple blocks and functions` without a depth guard. An attacker-controlled CSS value containing deeply nested blocks or functions can recurse until Ruby raises `SystemStackError`: stack level too deep, or cause excessive memory usage. Version 1.0.7 adds a configurable depth limit with a conservative default. This issue is fixed in version 1.0.7.
Last activity 30 Oct 2026. Patch Forecast updates every hour.