GitHub Advisoryadvisory · RubyGems

GHSA-6jxj-px6v-747w Crass: Deeply nested CSS blocks and functions can trigger a SystemStackError or excessive memory usage

MEDIUM Published 2026-10-29 Modified 2026-10-29 Official page ↗
Aliases
CVE-2026-61846
Ecosystem
RubyGems
Packages
crass
Severity
Moderate
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L
Weaknesses
CWE-400
Reviewed
2026-10-29

Affected packages

• RubyGems crass: < 1.0.7 → fixed in 1.0.7

Description

Impact Crass recursively parses CSS simple blocks and functions without a depth guard. An attacker-controlled value containing many deeply nested blocks can recurse until Ruby raises `SystemStackError: stack level too deep`, or can cause excessive memory usage. Patches This is fixed in Crass 1.0.7, which adds a configurable depth limit with a conservative default. Workarounds Add `SystemStackError` handling around Crass calls in your application. Buy more RAM.

Related

Alias · CVE (1)

  • CVE-2026-61846 Crass is a Ruby CSS parser that's fully compliant with the CSS Syntax Level 3 specification. vulnerability

Weakness · CWE (1)

  • CWE-400 Uncontrolled Resource Consumption weakness

References