Patch Forecast
Yellow warning
Plan into this sprint.

CVE-2026-61847 · GHSA-wwpr-jff3-395c

Crass: A large number of adjacent CSS comments can trigger a SystemStackError

Risk score
46/100
CVSS
6.3 v4.0
Exploit chance (30 days)
0.5%
Published
29 Oct 2026

Open in the live forecast Today's forecast

What to know

What it is
Crass is a Ruby CSS parser that's fully compliant with the CSS Syntax Level 3 specification. Prior to 1.0.7, when the :preserve_comments option is not enabled, which is the default, Crass discards CSS comments by recursively consuming the next token. An attacker-provided stylesheet containing a very large number of ad…
Affected
crass (rubygems) < 1.0.7
Fix
Upgrade crass to 1.0.7 or later.
Exploitation
No known exploitation

Story map

Story map: crassTHE FLAWSTHE FIXCVE-2026-61847Crass: A large number ofadjacent CSS comments cantrigger a SystemStackErrorCVSS 6.3 · EPSS 0%CVE-2026-61845Crass : Large numericexponents cause CPU andmemory denial of serviceCVSS 8.9 · EPSS 0%CVE-2026-61848Crass: Non-ASCII characterscause superlinear CPUconsumptionCVSS 6.3 · EPSS 0%CVE-2026-61846Crass: Deeply nested CSSblocks and functions cantrigger a SystemStackError…CVSS 6.3 · EPSS 0%Upgrade crass1.0.7or later on your release lineWho is exposed{'products': ['Crass'],'packages': ['crass'], 'versions':['< 1.0.7']}AMBER · PATCH THIS WEEKcrassCrass, a Ruby CSS parser, isvulnerable to a denial of serviceattack due to unboundedexponentiation in scientificnotation number values. Anattacker can cause adisproportionate CPU and…Where it standsNo known exploitationCONNECTS TOSame weaknessCWE-674 (CWE-674)75 other warnings in 30 days →
Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

crass: Amber, patch this week. Crass, a Ruby CSS parser, is vulnerable to a denial of service attack due to unbounded exponentiation in scientific notation number values. An attacker can cause a disproportionate CPU and memory usage, potentially resulting in a crash.

The flaws

  • CVE-2026-61847: Crass: A large number of adjacent CSS comments can trigger a SystemStackError (CVSS 6.3 · EPSS 0%)
  • CVE-2026-61845: Crass : Large numeric exponents cause CPU and memory denial of service (CVSS 8.9 · EPSS 0%)
  • CVE-2026-61848: Crass: Non-ASCII characters cause superlinear CPU consumption (CVSS 6.3 · EPSS 0%)
  • CVE-2026-61846: Crass: Deeply nested CSS blocks and functions can trigger a SystemStackError or excessive memory usage (CVSS 6.3 · EPSS 0%)

The fix

Upgrade crass: 1.0.7 or later on your release line

Who is exposed: {'products': ['Crass'], 'packages': ['crass'], 'versions': ['< 1.0.7']}

Where it stands

  • No known exploitation

Connects to

Why it is Yellow

  • CVSS 6.3 medium

Affected packages

PackageEcosystemVulnerableFixed in
crassrubygems< 1.0.71.0.7

References

Original description

Crass is a Ruby CSS parser that's fully compliant with the CSS Syntax Level 3 specification. Prior to 1.0.7, when the `:preserve_comments` option is not enabled, which is the default, Crass discards CSS comments by recursively consuming the next token. An attacker-provided stylesheet containing a very large number of adjacent comments can cause excessive recursion and trigger a `SystemStackError`, denying service to the parsing application. Preserving comments avoids this recursive path. This issue is fixed in version 1.0.7.

Last activity 30 Oct 2026. Patch Forecast updates every hour.