{"id":"CVE-2026-61845","kind":"vulnerability","aliases":["CVE-2026-61845","GHSA-6wmf-3r64-vcwv"],"related":[],"title":"Crass : Large numeric exponents cause CPU and memory denial of service","description":"### Impact\n\nCrass converts CSS scientific notation number values with unbounded exponentiation before it clamps the result to `Float::MAX`. Applications that use Crass to parse attacker-controlled CSS strings can be forced to spend disproportionate CPU and memory parsing a tiny input, possibly resulting in a crash.\n\n### Patches\n\nThis is fixed in Crass 1.0.7.\n\n### Related\n\n- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/crass/GHSA-6wmf-3r64-vcwv.yml","summary":"Crass is a Ruby CSS parser; versions before 1.0.7 convert scientific-notation numbers with unbounded exponents before clamping, so a tiny crafted CSS string makes parsing consume excessive CPU and memory. An attacker who can supply CSS to an application that parses it with Crass can cause a denial of service, possibly a crash.","severity":"high","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"crass","fixed":["1.0.7"],"affected":"< 1.0.7","ecosystem":"rubygems"}],"ecosystems":["rubygems"],"tags":["crass","css-parsing","cwe-674","package","ruby","rubygems"],"not_affected_if":["crass-below-1.0.7-absent","no-untrusted-css-input"],"how_to_check":"Run `bundle exec gem list crass` or check Gemfile.lock for crass versions below 1.0.7.","fix":"Upgrade the crass gem to 1.0.7 or later.","status":"open","published_at":"2026-10-20T14:32:39+00:00","first_seen_at":"2026-10-23T19:11:32+00:00","triaged_at":"2026-10-23T20:13:40+00:00","updated_at":"2026-10-23T20:13:40+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-23T20:13:40Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade the crass gem to 1.0.7 or later.\nunknown","summary":"Crass is a Ruby CSS parser; versions before 1.0.7 convert scientific-notation numbers with unbounded exponents before clamping, so a tiny crafted CSS string makes parsing consume excessive CPU and memory. An attacker who can supply CSS to an application that parses it with Crass can cause a denial of service, possibly a crash.","category":"package","who_cares":["ruby","rubygems","crass","css-parsing"],"confidence":0.8,"analyst_note":"","how_to_check":"Run `bundle exec gem list crass` or check Gemfile.lock for crass versions below 1.0.7.\nunknown\nunknown","needs_analyst":false,"not_affected_if":["crass-below-1.0.7-absent","no-untrusted-css-input"],"severity_if_unknown":"unknown"},"cost_usd":0.000372,"input_tokens":2133,"output_tokens":318,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,21A '-61845':14A,22A '-674':29B '/rubysec/ruby-advisory-db/blob/master/gems/crass/ghsa-6wmf-3r64-vcwv.yml':146C '1.0.7':41B,142C '3r64':18A '6wmf':17A 'applic':73B,107C 'attack':66B,114C 'attacker-control':113C 'caus':5A,80B 'clamp':51B,101C 'consum':60B 'control':115C 'convert':42B,90C 'cpu':6A,62B,124C 'craft':55B 'crash':87B,135C 'crass':1A,23A,24B,33B,78B,89C,110C,141C 'css':26B,37B,56B,70B,91C,116C 'css-pars':25B 'cve':12A,20A 'cwe':28B 'denial':9A,82B 'disproportion':123C 'excess':61B 'expon':4A,49B 'exponenti':98C 'fix':139C 'float':105C 'forc':120C 'ghsa':16A 'ghsa-6wmf-3r64-vcwv':15A 'github.com':145C 'github.com/rubysec/ruby-advisory-db/blob/master/gems/crass/ghsa-6wmf-3r64-vcwv.yml':144C 'impact':88C 'input':130C 'larg':2A 'make':58B 'max':106C 'memori':8A,64B,126C 'notat':45B,93C 'number':46B,94C 'numer':3A 'packag':30B 'pars':27B,59B,75B,112C,127C 'parser':38B 'patch':136C 'possibl':85B,131C 'relat':143C 'result':103C,132C 'rubi':31B,36B 'rubygem':32B 'scientif':44B,92C 'scientific-not':43B 'servic':11A,84B 'spend':122C 'string':57B,117C 'suppli':69B 'tini':54B,129C 'unbound':48B,97C 'use':109C 'valu':95C 'vcwv':19A 'version':39B","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T14:32:39+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-6wmf-3r64-vcwv","url":"https://github.com/advisories/GHSA-6wmf-3r64-vcwv","severity":"high","published_at":"2026-10-20T14:32:39+00:00","modified_at":"2026-10-20T14:32:40+00:00","first_seen_at":"2026-10-23T19:11:32+00:00","fetched_at":"2026-10-23T19:11:32+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}