GHSA-6wmf-3r64-vcwv CVE-2026-61845
Crass : Large numeric exponents cause CPU and memory denial of service
- Severity
- 0.0 / 10
- High · CVSS 4.0
- Exploit chance (EPSS)
- 0.39%
- Chance of exploitation in the next 30 days. Higher than 32.73% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-674 Uncontrolled Recursion
- Fix
1.0.7- Upgrade crass to this version or later
Description
Impact
Crass converts CSS scientific notation number values with unbounded exponentiation before it clamps the result to Float::MAX. Applications that use Crass to parse attacker-controlled CSS strings can be forced to spend disproportionate CPU and memory parsing a tiny input, possibly resulting in a crash.
Patches
This is fixed in Crass 1.0.7.
Related
Affected versions
RubyGems
| Package | Vulnerable | Fixed in |
|---|---|---|
| crass | < 1.0.7 |
1.0.7 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
crass RubyGems → 1.0.7
- bundler
bundle update crass # Gemfile: gem "crass", ">= 1.0.7"
Severity breakdown
CVSS 4.0 0.0
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H
- Attack vector
- Network
- Attack complexity
- Low
- Attack requirements
- Present
- Privileges required
- None
- User interaction
- None
- Confidentiality (vulnerable system)
- None
- Integrity (vulnerable system)
- None
- Availability (vulnerable system)
- High
- Confidentiality (subsequent systems)
- None
- Integrity (subsequent systems)
- None
- Availability (subsequent systems)
- High
Weakness
CWE-674: Uncontrolled Recursion
The product does not properly control the amount of recursion that takes place, consuming excessive resources, such as allocated memory or the program stack.
How to prevent it
- Implementation: Ensure that an end condition will be reached under all logic conditions. The end condition may include checking against the depth of recursion and exiting with an error if the recursion goes too deep. The complexity of the end condition contributes to the effectiveness of this action.
- Implementation: Increase the stack size.
References
Packages
Other links
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-8vfg-2r28-hvhj Crass: Non-ASCII characters cause superlinear CPU consumption | Medium | Also affects crass |
| GHSA-wwpr-jff3-395c Crass: A large number of adjacent CSS comments can trigger a SystemStackError | Medium | Also affects crass |
| GHSA-6jxj-px6v-747w Crass: Deeply nested CSS blocks and functions can trigger a SystemStackError or excessive memory usage | Medium | Also affects crass |
| GHSA-pq4g-8rxf-4g29 Crass: Incorrect tokenization of bad URLs enables CSS sanitizer bypass | Medium | Also affects crass |
| GHSA-hqq3-7jhf-c5jx Forge: Denial of service in TLS record processing via call stack exhaustion | High | Same weakness, CWE-674 |
| GHSA-vvm8-gf78-28g4 Go JOSE: Panics in JSON parsing | Medium | Same weakness, CWE-674 |
| EEF-CVE-2026-65628 Infinite recursion (CPU denial-of-service) in JOSE.JWK.shared_secret/2 on mismatched key types | Not rated yet | Same weakness, CWE-674 |
| GHSA-c9rx-x947-fp3h ApostropheCMS sanitize-html: unbounded recursion when re-sanitizing the fallback of a discarded iframe (stack overflow, nestingLimit not enforced) | Medium | Same weakness, CWE-674 |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor