GHSA-wwpr-jff3-395c CVE-2026-61847
Crass: A large number of adjacent CSS comments can trigger a SystemStackError
- Severity
- 0.0 / 10
- Medium · CVSS 4.0
- Exploit chance (EPSS)
- 0.49%
- Chance of exploitation in the next 30 days. Higher than 41.83% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-674 Uncontrolled Recursion
- Fix
1.0.7- Upgrade crass to this version or later
Description
Impact
When the :preserve_comments option is not enabled (which is the default behavior), Crass discards CSS comments by recursively consuming the next token. An attacker who provides a stylesheet containing a very large number of adjacent comments can cause excessive recursion and trigger a SystemStackError.
Patches
This is fixed in Crass 1.0.7, which no longer recurses when discarding comments.
Workarounds
Set the :preserve_comments option to true if this is acceptable to your use case (recursion doesn't occur when comments are preserved).
Affected versions
RubyGems
| Package | Vulnerable | Fixed in |
|---|---|---|
| crass | < 1.0.7 |
1.0.7 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
crass RubyGems → 1.0.7
- bundler
bundle update crass # Gemfile: gem "crass", ">= 1.0.7"
Severity breakdown
CVSS 4.0 0.0
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L
- Attack vector
- Network
- Attack complexity
- Low
- Attack requirements
- Present
- Privileges required
- None
- User interaction
- None
- Confidentiality (vulnerable system)
- None
- Integrity (vulnerable system)
- None
- Availability (vulnerable system)
- Low
- Confidentiality (subsequent systems)
- None
- Integrity (subsequent systems)
- None
- Availability (subsequent systems)
- Low
Weakness
CWE-674: Uncontrolled Recursion
The product does not properly control the amount of recursion that takes place, consuming excessive resources, such as allocated memory or the program stack.
How to prevent it
- Implementation: Ensure that an end condition will be reached under all logic conditions. The end condition may include checking against the depth of recursion and exiting with an error if the recursion goes too deep. The complexity of the end condition contributes to the effectiveness of this action.
- Implementation: Increase the stack size.
References
Packages
Other links
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-8vfg-2r28-hvhj Crass: Non-ASCII characters cause superlinear CPU consumption | Medium | Also affects crass |
| GHSA-6jxj-px6v-747w Crass: Deeply nested CSS blocks and functions can trigger a SystemStackError or excessive memory usage | Medium | Also affects crass |
| GHSA-pq4g-8rxf-4g29 Crass: Incorrect tokenization of bad URLs enables CSS sanitizer bypass | Medium | Also affects crass |
| GHSA-6wmf-3r64-vcwv Crass : Large numeric exponents cause CPU and memory denial of service | High | Also affects crass |
| GHSA-hqq3-7jhf-c5jx Forge: Denial of service in TLS record processing via call stack exhaustion | High | Same weakness, CWE-674 |
| GHSA-vvm8-gf78-28g4 Go JOSE: Panics in JSON parsing | Medium | Same weakness, CWE-674 |
| EEF-CVE-2026-65628 Infinite recursion (CPU denial-of-service) in JOSE.JWK.shared_secret/2 on mismatched key types | Not rated yet | Same weakness, CWE-674 |
| GHSA-c9rx-x947-fp3h ApostropheCMS sanitize-html: unbounded recursion when re-sanitizing the fallback of a discarded iframe (stack overflow, nestingLimit not enforced) | Medium | Same weakness, CWE-674 |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor