CVE-2026-61845: Rubygems/crass vulnerability

Q: Which applications are exposed to this issue?

Applications that use Crass to parse CSS strings controlled by an attacker are exposed. The impact is disproportionate CPU and memory consumption and a possible crash.

Q: What does an attacker need to provide?

The attacker needs to get a CSS string containing scientific-notation number values parsed by Crass. A small input can trigger unbounded exponentiation before the value is clamped.

Published Oct 20, 2026

Updated

Impact

Crass converts CSS scientific notation number values with unbounded exponentiation before it clamps the result to Float::MAX. Applications that use Crass to parse attacker-controlled CSS strings can be forced to spend disproportionate CPU and memory parsing a tiny input, possibly resulting in a crash.

Patches

This is fixed in Crass 1.0.7.

- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/crass/GHSA-6wmf-3r64-vcwv.yml

Affected Software

1 affected componentFixes available

rubygems/crass<1.0.7

1.0.7

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade rubygems/crass to a version that resolves this vulnerability.
Fixed in 1.0.7
Upgrade
Upgrade crass to a version that resolves this vulnerability.
Fixed in 1.0.7

Event History

Oct 20, 2026

Advisory Published

via GitHub·02:32 PM

Data Sourced

via GitHub·02:32 PM

DescriptionWeaknessAffected Software

Frequently Asked Questions

Which applications are exposed to this issue?

Applications that use Crass to parse CSS strings controlled by an attacker are exposed. The impact is disproportionate CPU and memory consumption and a possible crash.

What does an attacker need to provide?

The attacker needs to get a CSS string containing scientific-notation number values parsed by Crass. A small input can trigger unbounded exponentiation before the value is clamped.

What version addresses the issue?

Crass 1.0.7 fixes the issue.