CVE-2026-61846
Received Received - Intake

Stack Overflow in Crass Ruby CSS Parser

Publication date: 2026-10-30

Last updated on: 2026-10-30

Assigner: GitHub, Inc.

Description
Crass is a Ruby CSS parser that's fully compliant with the CSS Syntax Level 3 specification. Prior to 1.0.7, Crass recursively parses `CSS simple blocks and functions` without a depth guard. An attacker-controlled CSS value containing deeply nested blocks or functions can recurse until Ruby raises `SystemStackError`: stack level too deep, or cause excessive memory usage. Version 1.0.7 adds a configurable depth limit with a conservative default. This issue is fixed in version 1.0.7.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-30
Last Modified
2026-10-30
Generated
2026-10-30
AI Q&A
2026-10-30
EPSS Evaluated
N/A
NVD
CVE-2026-61846

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
rgrove crass < 1.0.7

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-674 The product does not properly control the amount of recursion that takes place, consuming excessive resources, such as allocated memory or the program stack.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Crass is a Ruby CSS parser that fully complies with CSS Syntax Level 3. Before version 1.0.7, it recursively parsed CSS simple blocks and functions without a depth limit. Attackers could exploit this by providing deeply nested CSS values, causing Ruby to crash with a SystemStackError due to excessive recursion or memory usage. Version 1.0.7 fixes this by adding a configurable depth limit.

Detection Guidance

This vulnerability can be detected by checking the version of Crass installed on your system. If the version is below 1.0.7, the system is vulnerable. Use the command 'gem list crass' to check the installed version.

Impact Analysis

If you use Crass versions before 1.0.7, an attacker could send maliciously crafted CSS input to crash your application or consume excessive memory, leading to denial-of-service conditions. This could disrupt services relying on Crass for CSS parsing.

Mitigation Strategies

Upgrade Crass to version 1.0.7 or later. If using Ruby gems, run 'gem install crass -v 1.0.7' or update the gem in your project's Gemfile. Ensure all dependencies are updated to avoid compatibility issues.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-61846. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart