{"id":"CVE-2026-61848","kind":"vulnerability","aliases":["CVE-2026-61848","GHSA-8vfg-2r28-hvhj"],"related":[],"title":"Crass: Non-ASCII characters cause superlinear CPU consumption","description":"### Impact\n\nWhen parsing an input containing non-ASCII characters, inefficiencies in how Crass tracks the positions of multi-byte characters result in superlinear parsing time. An attacker-controlled input consisting of many non-ASCII characters could cause excessive CPU consumption and potentially denial of service.\n\n### Patches\n\nThis is fixed in Crass 1.0.7.\n\n### Workarounds\n\nAvoid passing non-ASCII input to Crass. Or cultivate patience.","summary":"Crass, a Ruby CSS parser gem, slows down sharply when parsing input full of non-ASCII characters because it inefficiently tracks multi-byte character positions. An attacker who controls the input can use up excessive CPU and cause a denial of service.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"crass","fixed":["1.0.7"],"affected":"< 1.0.7","ecosystem":"rubygems"}],"ecosystems":["rubygems"],"tags":["crass","css-parsing","cwe-400","package","ruby","rubygems"],"not_affected_if":["ascii-only-input","no-untrusted-css-parsing"],"how_to_check":"- Check the installed version with `gem list crass` or the `crass` line in `Gemfile.lock`.\n- Look for any code path where untrusted input is passed to Crass.","fix":"- Upgrade `crass` to `1.0.7` or later.","status":"open","published_at":"2026-10-29T16:35:29+00:00","first_seen_at":"2026-10-29T16:39:02+00:00","triaged_at":"2026-10-29T16:39:47+00:00","updated_at":"2026-10-29T16:39:47+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-29T16:39:47Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade `crass` to `1.0.7` or later.","reach":"unknown","title":"Crass Ruby gem: non-ASCII input causes superlinear CPU use, denial of service","impact":"low","summary":"Crass, a Ruby CSS parser gem, slows down sharply when parsing input full of non-ASCII characters because it inefficiently tracks multi-byte character positions. An attacker who controls the input can use up excessive CPU and cause a denial of service.","audience":"developers","category":"package","nicknames":[],"who_cares":["ruby","rubygems","crass","css-parsing"],"confidence":0.8,"fix_status":"available","needs_auth":"unknown","worst_case":"Excessive CPU use leads to denial of service on the parsing server","analyst_note":"","how_to_check":"- Check the installed version with `gem list crass` or the `crass` line in `Gemfile.lock`.\n- Look for any code path where untrusted input is passed to Crass.","plain_action":"","needs_analyst":false,"not_affected_if":["ascii-only-input","no-untrusted-css-parsing"],"who_is_affected":"Applications that pass attacker-controllable text containing non-ASCII characters into Crass, typically through Ruby code that parses CSS from user input or external sources. Projects that only parse trusted, ASCII-only stylesheets are unlikely to be exposed. The sources do not say which dependent gems or frameworks call Crass on untrusted input.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.0007,"input_tokens":4262,"output_tokens":548,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':11A,19A '-400':27B '-61848':12A,20A '1.0.7':130C '2r28':16A '8vfg':15A 'ascii':4A,47B,83C,112C,136C 'attack':59B,104C 'attacker-control':103C 'avoid':132C 'byte':55B,95C 'caus':6A,70B,115C 'charact':5A,48B,56B,84C,96C,113C 'consist':107C 'consumpt':9A,118C 'contain':80C 'control':61B,105C 'could':114C 'cpu':8A,68B,117C 'crass':1A,21A,22B,31B,88C,129C,139C 'css':24B,34B 'css-pars':23B 'cultiv':141C 'cve':10A,18A 'cwe':26B 'denial':72B,121C 'excess':67B,116C 'fix':127C 'full':43B 'gem':36B 'ghsa':14A 'ghsa-8vfg-2r28-hvhj':13A 'hvhj':17A 'impact':75C 'ineffici':51B,85C 'input':42B,63B,79C,106C,137C 'mani':109C 'multi':54B,94C 'multi-byt':53B,93C 'non':3A,46B,82C,111C,135C 'non-ascii':2A,45B,81C,110C,134C 'packag':28B 'pars':25B,41B,77C,100C 'parser':35B 'pass':133C 'patch':124C 'patienc':142C 'posit':57B,91C 'potenti':120C 'result':97C 'rubi':29B,33B 'rubygem':30B 'servic':74B,123C 'sharpli':39B 'slow':37B 'superlinear':7A,99C 'time':101C 'track':52B,89C 'use':65B 'workaround':131C","nicknames":[],"mitigations":[],"who_affected":"Applications that pass attacker-controllable text containing non-ASCII characters into Crass, typically through Ruby code that parses CSS from user input or external sources. Projects that only parse trusted, ASCII-only stylesheets are unlikely to be exposed. The sources do not say which dependent gems or frameworks call Crass on untrusted input.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"first_public_at":"2026-10-29T16:35:29+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-8vfg-2r28-hvhj","url":"https://github.com/advisories/GHSA-8vfg-2r28-hvhj","severity":"medium","published_at":"2026-10-29T16:35:29+00:00","modified_at":"2026-10-29T16:35:33+00:00","first_seen_at":"2026-10-29T16:39:02+00:00","fetched_at":"2026-10-29T16:39:02+00:00","note":null}],"documents":[{"id":17819,"url":"https://api.github.com/repos/rgrove/crass/security-advisories/GHSA-8vfg-2r28-hvhj","title":"Maintainer's advisory: api.github.com","kind":"vendor","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Maintainer's advisory: api.github.com"},{"id":17820,"url":"https://github.com/rgrove/crass/security/advisories/GHSA-8vfg-2r28-hvhj","title":"Maintainer's advisory: github.com","kind":"vendor","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Maintainer's advisory: github.com"},{"id":17821,"url":"https://github.com/rgrove/crass/releases/tag/v1.0.7","title":"Release: github.com","kind":"release","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release: github.com"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}