Live › vulnerability › CVE-2026-61848
Crass, a Ruby CSS parser gem, slows down sharply when parsing input full of non-ASCII characters because it inefficiently tracks multi-byte character positions. An attacker who controls the input can use up excessive CPU and cause a denial of service.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 16:39 UTC. All times on this page are UTC.
Applications that pass attacker-controllable text containing non-ASCII characters into Crass, typically through Ruby code that parses CSS from user input or external sources. Projects that only parse trusted, ASCII-only stylesheets are unlikely to be exposed. The sources do not say which dependent gems or frameworks call Crass on untrusted input.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| crass | rubygems | < 1.0.7 | 1.0.7 |
gem list crass or the crass line in Gemfile.lock.crass to 1.0.7 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
When parsing an input containing non-ASCII characters, inefficiencies in how Crass tracks the positions of multi-byte characters result in superlinear parsing time. An attacker-controlled input consisting of many non-ASCII characters could cause excessive CPU consumption and potentially denial of service.
This is fixed in Crass 1.0.7.
Avoid passing non-ASCII input to Crass. Or cultivate patience.
This page as .md · .json · in your agent: get_signal("CVE-2026-61848")
GitHub Advisory Database, CC-BY 4.0. Posts quoted belong to their authors.