CVE-2026-61845
Received Received - Intake

Crass Ruby CSS Parser Scientific Notation Parsing DoS

Publication date: 2026-10-30

Last updated on: 2026-10-30

Assigner: GitHub, Inc.

Description
Crass is a Ruby CSS parser that's fully compliant with the CSS Syntax Level 3 specification. Prior to 1.0.7, Crass converts `CSS scientific notation` number values with unbounded exponentiation before clamping the result to `Float::MAX`. Applications that use Crass to parse attacker-controlled CSS strings can be forced to spend disproportionate CPU and memory parsing a tiny input, potentially resulting in a crash. This issue is fixed in version 1.0.7.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-30
Last Modified
2026-10-30
Generated
2026-10-30
AI Q&A
2026-10-30
EPSS Evaluated
N/A
NVD
CVE-2026-61845

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
rgrove crass < 1.0.7

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-789 The product allocates memory based on an untrusted, large size value, but it does not ensure that the size is within expected limits, allowing arbitrary amounts of memory to be allocated.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Crass is a Ruby CSS parser that converts CSS scientific notation numbers with unbounded exponentiation before clamping results. Before version 1.0.7, attackers could craft tiny CSS inputs that force excessive CPU and memory usage during parsing, potentially crashing the application.

Detection Guidance

Detecting this vulnerability requires checking the version of Crass in use. If your application uses Crass for CSS parsing, verify if the version is below 1.0.7. Commands may include checking gem versions (gem list crass) or inspecting dependency files (Gemfile.lock).

Impact Analysis

If you use Crass to parse untrusted CSS, an attacker could send a malicious CSS string causing your system to consume abnormal resources. This may lead to slowdowns, unresponsiveness, or crashes, disrupting services relying on the parser.

Mitigation Strategies

Upgrade Crass to version 1.0.7 or later immediately. If using Ruby gems, run gem update crass. For applications with dependency managers, update the Gemfile to specify version 1.0.7 or higher and reinstall dependencies.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-61845. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart