CVE-2026-61846 Details
Description
Crass is a Ruby CSS parser that's fully compliant with the CSS Syntax Level 3 specification. Prior to 1.0.7, Crass recursively parses `CSS simple blocks and functions` without a depth guard. An attacker-controlled CSS value containing deeply nested blocks or functions can recurse until Ruby raises `SystemStackError`: stack level too deep, or cause excessive memory usage. Version 1.0.7 adds a configurable depth limit with a conservative default. This issue is fixed in version 1.0.7.
A denial-of-service vulnerability has been identified in the Crass Ruby library, which is a CSS parser compliant with the CSS Syntax Level 3 specification. Prior to version 1.0.7, Crass lacked a depth guard when recursively parsing CSS simple blocks and functions. This vulnerability allows an attacker to craft a CSS value with deeply nested blocks or functions, leading to a stack overflow (SystemStackError) or excessive memory consumption. The issue is fixed in version 1.0.7, which introduces a configurable depth limit with a conservative default of 25.
Users can update to Crass version 1.0.7 or later, which includes the necessary depth limit. For applications that cannot be immediately updated, Crass calls can be wrapped with error handling for SystemStackError.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 30, 2026CISA-ADP
Assessed Nov 5, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/rgrove/crass/commit/cf68287356ec6e20d51cfc4a2d0c3912b7334e99 | [email protected] | Source CodeVendor |
| https://github.com/rgrove/crass/releases/tag/v1.0.7 | [email protected] | Release NotesVendor |
| https://github.com/rgrove/crass/security/advisories/GHSA-6jxj-px6v-747w | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-674 | Uncontrolled Recursion | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Crass | < 1.0.7 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 5, 2026 | CVE Modified | CISA-ADP |
| Oct 30, 2026 | New CVE Received | [email protected] |