CVE-2026-61847 Details
Description
Crass is a Ruby CSS parser that's fully compliant with the CSS Syntax Level 3 specification. Prior to 1.0.7, when the `:preserve_comments` option is not enabled, which is the default, Crass discards CSS comments by recursively consuming the next token. An attacker-provided stylesheet containing a very large number of adjacent comments can cause excessive recursion and trigger a `SystemStackError`, denying service to the parsing application. Preserving comments avoids this recursive path. This issue is fixed in version 1.0.7.
A denial-of-service vulnerability has been identified in the Crass Ruby library, specifically in versions prior to 1.0.7. When the default option ':preserve_comments' is not enabled, Crass removes CSS comments by recursively processing the next token. An attacker can exploit this behavior by sending a stylesheet with a large number of adjacent comments, leading to excessive recursion and a 'SystemStackError', which disrupts the parsing application. This issue arises because the comment removal process is recursive, creating a risk of stack exhaustion. The vulnerability is mitigated in version 1.0.7, where comments are skipped iteratively, preventing stack overflow.
Users can upgrade to Crass version 1.0.7 or later to address this vulnerability. If immediate upgrading is not possible, comments can be preserved during parsing by setting the ':preserve_comments' option to true, although this may not be suitable for all use cases.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 30, 2026CISA-ADP
Assessed Oct 30, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/rgrove/crass/commit/25d78cc607c54262e9d43ea1930f3ba5bb03dfb5 | [email protected] | Source CodeVendor |
| https://github.com/rgrove/crass/releases/tag/v1.0.7 | [email protected] | Release NotesVendor |
| https://github.com/rgrove/crass/security/advisories/GHSA-wwpr-jff3-395c | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-674 | Uncontrolled Recursion | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Crass | < 1.0.7 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 30, 2026 | CVE Modified | CISA-ADP |
| Oct 30, 2026 | New CVE Received | [email protected] |