Multiple vulnerabilities have been identified in the Crass package, a Ruby CSS parsing library. The issues affect the parser's handling of deeply nested structures, adjacent comments, and non-ASCII input, potentially allowing an unauthenticated remote attacker to cause excessive resource consumption or a stack error. The overall risk is denial of service for applications that process attacker-controlled CSS or similar structured input.
CVE-2026-61846 (CVSS 6.3 — Medium): The Crass parser recursively processes CSS blocks and functions without sufficient depth protection. An unauthenticated remote attacker can supply deeply nested CSS input to trigger a SystemStackError or excessive memory usage.[/subscribe_to_unlock_form]
Multiple vulnerabilities have been identified in the Crass package, a Ruby CSS parsing library. The issues affect the parser's handling of deeply nested structures, adjacent comments, and non-ASCII input, potentially allowing an unauthenticated remote attacker to cause excessive resource consumption or a stack error. The overall risk is denial of service for applications that process attacker-controlled CSS or similar structured input.
CVE-2026-61846 (CVSS 6.3 — Medium): The Crass parser recursively processes CSS blocks and functions without sufficient depth protection. An unauthenticated remote attacker can supply deeply nested CSS input to trigger a SystemStackError or excessive memory usage.[emaillocker id="1283"]
CVE-2026-61847 (CVSS 6.3 — Medium): It is a vulnerability in Crass where processing a large number of adjacent CSS comments with the :preserve_comments option disabled causes excessive recursion, allowing an unauthenticated remote attacker to trigger a SystemStackError.
CVE-2026-61848 (CVSS 6.3 — Medium): Crass inefficiently tracks positions of multi-byte characters while parsing non-ASCII input. An unauthenticated remote attacker can provide input with many non-ASCII characters to cause superlinear CPU consumption and potential denial of service.
We recommend you to update crass to version 1.0.8 or later.
The following reports contain further technical details:
[/emaillocker]