Live › vulnerability › CVE-2026-61846
Crass is a Ruby CSS parser that recurses through nested CSS blocks and functions without a depth limit. A crafted CSS value with many deep nestings can raise a stack overflow error or consume excessive memory, causing denial of service.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 16:39 UTC. All times on this page are UTC.
Applications that pass untrusted or user-supplied CSS into Crass, directly or through gems that depend on it such as Rails mail or sanitization stacks, are exposed. Applications that only parse CSS they author themselves are much less exposed. The sources do not list other preconditions.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| crass | rubygems | < 1.0.7 | 1.0.7 |
gem list crass or by inspecting the Gemfile.lock for crass.crass to 1.0.7 or later, which adds a configurable depth limit.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Crass recursively parses CSS simple blocks and functions without a depth guard. An attacker-controlled value containing many deeply nested blocks can recurse until Ruby raises SystemStackError: stack level too deep, or can cause excessive memory usage.
This is fixed in Crass 1.0.7, which adds a configurable depth limit with a conservative default.
Add SystemStackError handling around Crass calls in your application. Buy more RAM.
This page as .md · .json · in your agent: get_signal("CVE-2026-61846")
GitHub Advisory Database, CC-BY 4.0. Posts quoted belong to their authors.