{"id":"CVE-2026-61846","kind":"vulnerability","aliases":["CVE-2026-61846","GHSA-6jxj-px6v-747w"],"related":[],"title":"Crass: Deeply nested CSS blocks and functions can trigger a SystemStackError or excessive memory usage","description":"### Impact\n\nCrass recursively parses CSS simple blocks and functions without a depth guard. An attacker-controlled value containing many deeply nested blocks can recurse until Ruby raises `SystemStackError: stack level too deep`, or can cause excessive memory usage.\n\n### Patches\n\nThis is fixed in Crass 1.0.7, which adds a configurable depth limit with a conservative default.\n\n### Workarounds\n\nAdd `SystemStackError` handling around Crass calls in your application. Buy more RAM.","summary":"Crass is a Ruby CSS parser that recurses through nested CSS blocks and functions without a depth limit. A crafted CSS value with many deep nestings can raise a stack overflow error or consume excessive memory, causing denial of service.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"crass","fixed":["1.0.7"],"affected":"< 1.0.7","ecosystem":"rubygems"}],"ecosystems":["rubygems"],"tags":["crass","cwe-400","package","ruby","rubygems"],"not_affected_if":["crass-not-used","trusted-input-only"],"how_to_check":"- Check the installed version with `gem list crass` or by inspecting the `Gemfile.lock` for `crass`.\n- Look for any application code that passes attacker-controlled CSS strings into Crass.","fix":"- Upgrade `crass` to `1.0.7` or later, which adds a configurable depth limit.","status":"open","published_at":"2026-10-29T16:35:16+00:00","first_seen_at":"2026-10-29T16:39:03+00:00","triaged_at":"2026-10-29T16:39:50+00:00","updated_at":"2026-10-29T16:39:50+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-29T16:39:50Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade `crass` to `1.0.7` or later, which adds a configurable depth limit.","reach":"unknown","title":"Crass: deeply nested CSS input crashes Ruby parser or exhausts memory","impact":"low","summary":"Crass is a Ruby CSS parser that recurses through nested CSS blocks and functions without a depth limit. A crafted CSS value with many deep nestings can raise a stack overflow error or consume excessive memory, causing denial of service.","audience":"developers","category":"package","nicknames":[],"who_cares":["ruby","rubygems","crass"],"confidence":0.7,"fix_status":"available","needs_auth":"unknown","worst_case":"Parser crashes or server process exhausts memory, causing denial of service","analyst_note":"","how_to_check":"- Check the installed version with `gem list crass` or by inspecting the `Gemfile.lock` for `crass`.\n- Look for any application code that passes attacker-controlled CSS strings into Crass.","plain_action":"","needs_analyst":false,"not_affected_if":["trusted-input-only","crass-not-used"],"who_is_affected":"Applications that pass untrusted or user-supplied CSS into Crass, directly or through gems that depend on it such as Rails mail or sanitization stacks, are exposed. Applications that only parse CSS they author themselves are much less exposed. The sources do not list other preconditions.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000692,"input_tokens":4294,"output_tokens":526,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':17A,25A '-400':30B '-61846':18A,26A '1.0.7':119C '6jxj':21A '747w':23A 'add':121C,131C 'applic':139C 'around':134C 'attack':89C 'attacker-control':88C 'block':5A,45B,80C,96C 'buy':140C 'call':136C 'caus':70B,109C 'configur':123C 'conserv':128C 'consum':67B 'contain':92C 'control':90C 'craft':53B 'crass':1A,27A,28B,34B,75C,118C,135C 'css':4A,38B,44B,54B,78C 'cve':16A,24A 'cwe':29B 'deep':58B,106C 'deepli':2A,94C 'default':129C 'denial':71B 'depth':50B,85C,124C 'error':65B 'excess':13A,68B,110C 'fix':116C 'function':7A,47B,82C 'ghsa':20A 'ghsa-6jxj-px6v-747w':19A 'guard':86C 'handl':133C 'impact':74C 'level':104C 'limit':51B,125C 'mani':57B,93C 'memori':14A,69B,111C 'nest':3A,43B,59B,95C 'overflow':64B 'packag':31B 'pars':77C 'parser':39B 'patch':113C 'px6v':22A 'rais':61B,101C 'ram':142C 'recurs':41B,76C,98C 'rubi':32B,37B,100C 'rubygem':33B 'servic':73B 'simpl':79C 'stack':63B,103C 'systemstackerror':11A,102C,132C 'trigger':9A 'usag':15A,112C 'valu':55B,91C 'without':48B,83C 'workaround':130C","nicknames":[],"mitigations":[],"who_affected":"Applications that pass untrusted or user-supplied CSS into Crass, directly or through gems that depend on it such as Rails mail or sanitization stacks, are exposed. Applications that only parse CSS they author themselves are much less exposed. The sources do not list other preconditions.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"first_public_at":"2026-10-29T16:35:16+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-6jxj-px6v-747w","url":"https://github.com/advisories/GHSA-6jxj-px6v-747w","severity":"medium","published_at":"2026-10-29T16:35:16+00:00","modified_at":"2026-10-29T16:35:18+00:00","first_seen_at":"2026-10-29T16:39:03+00:00","fetched_at":"2026-10-29T16:39:03+00:00","note":null}],"documents":[{"id":17826,"url":"https://api.github.com/repos/rgrove/crass/security-advisories/GHSA-6jxj-px6v-747w","title":"Maintainer's advisory: api.github.com","kind":"vendor","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Maintainer's advisory: api.github.com"},{"id":17827,"url":"https://github.com/rgrove/crass/security/advisories/GHSA-6jxj-px6v-747w","title":"Maintainer's advisory: github.com","kind":"vendor","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Maintainer's advisory: github.com"},{"id":17828,"url":"https://github.com/rgrove/crass/commit/cf68287356ec6e20d51cfc4a2d0c3912b7334e99","title":"Patch: github.com","kind":"other","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":17821,"url":"https://github.com/rgrove/crass/releases/tag/v1.0.7","title":"Release: github.com","kind":"release","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release: github.com"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}