Live › vulnerability › CVE-2026-61845
Go to dashboardCrass is a Ruby CSS parser; versions before 1.0.7 convert scientific-notation numbers with unbounded exponents before clamping, so a tiny crafted CSS string makes parsing consume excessive CPU and memory. An attacker who can supply CSS to an application that parses it with Crass can cause a denial of service, possibly a crash.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:11 UTC. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| crass | rubygems | < 1.0.7 | 1.0.7 |
Run bundle exec gem list crass or check Gemfile.lock for crass versions below 1.0.7.
Upgrade the crass gem to 1.0.7 or later.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Crass converts CSS scientific notation number values with unbounded exponentiation before it clamps the result to Float::MAX. Applications that use Crass to parse attacker-controlled CSS strings can be forced to spend disproportionate CPU and memory parsing a tiny input, possibly resulting in a crash.
This is fixed in Crass 1.0.7.
This page as .md · .json · in your agent: get_signal("CVE-2026-61845")
GitHub Advisory Database, CC-BY 4.0. Posts quoted belong to their authors.